mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-28 13:17:23 +00:00
Merge branch 'master' into v-tea-CI-111362
This commit is contained in:
Teresa-Motiv
commit
e2aeda2c43
@ -44,7 +44,7 @@ If you're having trouble deciding whether Microsoft Edge is right for your organ
|
||||
|
||||
|Microsoft Edge |IE11 |
|
||||
|---------|---------|
|
||||
|Microsoft Edge takes you beyond just browsing to actively engaging with the web through features like Web Note, Reading View, and Cortana.<ul><li>**Web Note.** Microsoft Edge lets you annotate, highlight, and call things out directly on web pages.</li><li>**Reading view.** Microsoft Edge lets you enjoy and print online articles in a distraction-free layout optimized for your screen size. While in reading view, you can also save web pages or PDF files to your reading list, for later viewing.</li><li>**Cortana.** Enabled by default in Microsoft Edge, Cortana lets you highlight words for more info and gives you one-click access to things like restaurant reservations and reviews, without leaving the webpage.</li><li>**Compatibility and security.** Microsoft Edge lets you continue to use IE11 for sites that are on your corporate intranet or that are included on your Enterprise Mode Site List. You must use IE11 to run older, less secure technology, such as ActiveX controls.</li></ul> |IE11 offers enterprises additional security, manageability, performance, backward compatibility, and modern standards support.<ul><li>**Backward compatibility.** IE11 supports 9 document modes that include high-fidelity emulations for older versions of IE.</li><li>**Modern web standards.** IE11 supports modern web technologies like HTML5, CSS3, and WebGL, which help to ensure today's modern websites and apps work just as well as your old, legacy websites and apps. **IE11 does not support some modern CSS properties, JavaScript modules and certain APIs.**</li><li>**More secure.** IE11 was designed with security in mind and is more secure than older versions. Using security features like SmartScreen and Enhanced Protected Mode can help IE11 reduce your risk.</li><li>**Faster.** IE11 is significantly faster than previous versions of Internet Explorer, taking advantage of network optimization and hardware-accelerated text, graphics, and JavaScript rendering.</li><li>**Easier migration to Windows 10.** IE11 is the only version of IE that runs on Windows 7, Windows 8.1, and Windows 10. Upgrading to IE11 on Windows 7 can also help your organization support the next generation of software, services, and devices.</li><li>**Administration.** IE11 can use the Internet Explorer Administration Kit (IEAK) 11 or MSIs for deployment and includes more than 1,600 Group Policies and preferences for granular control.</li></ul> |
|
||||
|Microsoft Edge takes you beyond just browsing to actively engaging with the web through features like Web Note, Reading View, and Cortana.<ul><li>**Web Note.** Microsoft Edge lets you annotate, highlight, and call things out directly on web pages.</li><li>**Reading view.** Microsoft Edge lets you enjoy and print online articles in a distraction-free layout optimized for your screen size. While in reading view, you can also save web pages or PDF files to your reading list, for later viewing.</li><li>**Cortana.** Enabled by default in Microsoft Edge, Cortana lets you highlight words for more info and gives you one-click access to things like restaurant reservations and reviews, without leaving the webpage.</li><li>**Compatibility and security.** Microsoft Edge lets you continue to use IE11 for sites that are on your corporate intranet or that are included on your Enterprise Mode Site List. You must use IE11 to run older, less secure technology, such as ActiveX controls.</li></ul> |IE11 offers enterprises additional security, manageability, performance, backward compatibility, and modern standards support.<ul><li>**Backward compatibility.** IE11 supports 9 document modes that include high-fidelity emulations for older versions of IE.</li><li>**Modern web standards.** IE11 supports modern web technologies like HTML5, CSS3, and WebGL, which help to ensure today's modern websites and apps work just as well as your old, legacy websites and apps. **IE11 does not support some modern CSS properties, JavaScript modules and certain APIs.**</li><li>**More secure.** IE11 was designed with security in mind and is more secure than older versions. Using security features like Windows Defender SmartScreen and Enhanced Protected Mode can help IE11 reduce your risk.</li><li>**Faster.** IE11 is significantly faster than previous versions of Internet Explorer, taking advantage of network optimization and hardware-accelerated text, graphics, and JavaScript rendering.</li><li>**Easier migration to Windows 10.** IE11 is the only version of IE that runs on Windows 7, Windows 8.1, and Windows 10. Upgrading to IE11 on Windows 7 can also help your organization support the next generation of software, services, and devices.</li><li>**Administration.** IE11 can use the Internet Explorer Administration Kit (IEAK) 11 or MSIs for deployment and includes more than 1,600 Group Policies and preferences for granular control.</li></ul> |
|
||||
|
||||
|
||||
## Configure the Enterprise Mode Site List
|
||||
|
||||
@ -1,50 +1,51 @@
|
||||
---
|
||||
author: eavena
|
||||
ms.author: eravena
|
||||
ms.date: 10/02/2018
|
||||
ms.reviewer:
|
||||
audience: itpro
manager: dansimp
|
||||
ms.prod: edge
|
||||
ms.topic: include
|
||||
---
|
||||
|
||||
<!-- ## Configure Windows Defender SmartScreen -->
|
||||
>*Supported versions: Microsoft Edge on Windows 10*<br>
|
||||
>*Default setting: Enabled (Turned on)*
|
||||
|
||||
[!INCLUDE [configure-windows-defender-smartscreen-shortdesc](../shortdesc/configure-windows-defender-smartscreen-shortdesc.md)]
|
||||
|
||||
### Supported values
|
||||
|
||||
| Group Policy | MDM | Registry | Description | Most restricted |
|
||||
|----------------|:-----:|:--------:|-----------------------------------------------------------------------------------------------|:------------------------------------------------:|
|
||||
| Not configured | Blank | Blank | Users can choose to use Windows Defender SmartScreen. | |
|
||||
| Disabled | 0 | 0 | Turned off. Do not protect users from potential threats and prevent users from turning it on. | |
|
||||
| Enabled | 1 | 1 | Turned on. Protect users from potential threats and prevent users from turning it off. |  |
|
||||
|
||||
---
|
||||
|
||||
To verify Windows Defender SmartScreen is turned off (disabled):
|
||||
1. Click or tap **More** (…) and select **Settings** > **View Advanced settings**.
|
||||
2. Verify the setting **Help protect me from malicious sites and download with SmartScreen Filter** is disabled.<p>
|
||||
|
||||
|
||||
### ADMX info and settings
|
||||
#### ADMX info
|
||||
- **GP English name:** Configure Windows Defender SmartScreen
|
||||
- **GP name:** AllowSmartScreen
|
||||
- **GP path:** Windows Components/Microsoft Edge
|
||||
- **GP ADMX file name:** MicrosoftEdge.admx
|
||||
|
||||
#### MDM settings
|
||||
- **MDM name:** Browser/[AllowSmartScreen](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowsmartscreen)
|
||||
- **Supported devices:** Desktop and Mobile
|
||||
- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowSmartScreen
|
||||
- **Data type:** Integer
|
||||
|
||||
#### Registry settings
|
||||
- **Path:** HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter
|
||||
- **Value name:** EnabledV9
|
||||
- **Value type:** REG_DWORD
|
||||
|
||||
<hr>
|
||||
---
|
||||
author: eavena
|
||||
ms.author: eravena
|
||||
ms.date: 10/02/2018
|
||||
ms.reviewer:
|
||||
audience: itpro
|
||||
manager: dansimp
|
||||
ms.prod: edge
|
||||
ms.topic: include
|
||||
---
|
||||
|
||||
<!-- ## Configure Windows Defender SmartScreen -->
|
||||
>*Supported versions: Microsoft Edge on Windows 10*<br>
|
||||
>*Default setting: Enabled (Turned on)*
|
||||
|
||||
[!INCLUDE [configure-windows-defender-smartscreen-shortdesc](../shortdesc/configure-windows-defender-smartscreen-shortdesc.md)]
|
||||
|
||||
### Supported values
|
||||
|
||||
| Group Policy | MDM | Registry | Description | Most restricted |
|
||||
|----------------|:-----:|:--------:|-----------------------------------------------------------------------------------------------|:------------------------------------------------:|
|
||||
| Not configured | Blank | Blank | Users can choose to use Windows Defender SmartScreen. | |
|
||||
| Disabled | 0 | 0 | Turned off. Do not protect users from potential threats and prevent users from turning it on. | |
|
||||
| Enabled | 1 | 1 | Turned on. Protect users from potential threats and prevent users from turning it off. |  |
|
||||
|
||||
---
|
||||
|
||||
To verify Windows Defender SmartScreen is turned off (disabled):
|
||||
1. Click or tap **More** (…) and select **Settings** > **View Advanced settings**.
|
||||
2. Verify the setting **Help protect me from malicious sites and download with Windows Defender SmartScreen** is disabled.<p>
|
||||
|
||||
|
||||
### ADMX info and settings
|
||||
#### ADMX info
|
||||
- **GP English name:** Configure Windows Defender SmartScreen
|
||||
- **GP name:** AllowSmartScreen
|
||||
- **GP path:** Windows Components/Microsoft Edge
|
||||
- **GP ADMX file name:** MicrosoftEdge.admx
|
||||
|
||||
#### MDM settings
|
||||
- **MDM name:** Browser/[AllowSmartScreen](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowsmartscreen)
|
||||
- **Supported devices:** Desktop and Mobile
|
||||
- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowSmartScreen
|
||||
- **Data type:** Integer
|
||||
|
||||
#### Registry settings
|
||||
- **Path:** HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter
|
||||
- **Value name:** EnabledV9
|
||||
- **Value type:** REG_DWORD
|
||||
|
||||
<hr>
|
||||
|
||||
@ -40,7 +40,7 @@ sections:
|
||||
- items:
|
||||
- type: markdown
|
||||
text: "
|
||||
Microsoft Edge uses Windows Hello and SmartScreen to defend against phishing and malware. Take a look at some of the additional features behind the strong defense that Microsoft Edge provides against web-based attacks.<br>
|
||||
Microsoft Edge uses Windows Hello and Windows Defender SmartScreen to defend against phishing and malware. Take a look at some of the additional features behind the strong defense that Microsoft Edge provides against web-based attacks.<br>
|
||||
<table><tr><td><img src='images/security1.png' width='192' height='192'><br>**NSS Labs web browser security reports**<br>See the results of two global tests measuring how effective browsers are at protecting against socially engineered malware and phishing attacks.<br><a href='https://www.microsoft.com/download/details.aspx?id=54773'>Download the reports</a></td><td><img src='images/security2.png' width='192' height='192'><br>**Microsoft Edge sandbox**<br>See how Microsoft Edge has significantly reduced the attack surface of the sandbox by configuring the app container to further reduce its privilege.<br><a href='https://blogs.windows.com/msedgedev/2017/03/23/strengthening-microsoft-edge-sandbox/'>Find out more</a></td><td><img src='images/security3.png' width='192' height='192'><br>**Windows Defender SmartScreen**<br>Manage your organization's computer settings with Group Policy and MDM settings to display a warning page to employees or block a site entirely.<br><a href='https://docs.microsoft.com/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview'>Read the docs</a></td></tr>
|
||||
</table>
|
||||
"
|
||||
|
||||
@ -157,13 +157,13 @@ This table includes the attributes used by the Enterprise Mode schema.
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><version></td>
|
||||
<td>version</td>
|
||||
<td>Specifies the version of the Enterprise Mode Site List. This attribute is supported for the <rules> element.</td>
|
||||
<td>Internet Explorer 11 and Microsoft Edge</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><exclude></td>
|
||||
<td>Specifies the domain or path excluded from applying the behavior and is supported on the <domain> and <path> elements.
|
||||
<td>exclude</td>
|
||||
<td>Specifies the domain or path is excluded from applying Enterprise Mode. This attribute is only supported on the <domain> and <path> elements in the <emie> section.
|
||||
<p><b>Example</b>
|
||||
<pre class="syntax">
|
||||
<emie>
|
||||
@ -175,7 +175,7 @@ Where <a href="https://fabrikam.com" data-raw-source="https://fabrikam.com">http
|
||||
<td>Internet Explorer 11 and Microsoft Edge</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><docMode></td>
|
||||
<td>docMode</td>
|
||||
<td>Specifies the document mode to apply. This attribute is only supported on <domain> or <path> elements in the <docMode> section.
|
||||
<p><b>Example</b>
|
||||
<pre class="syntax">
|
||||
|
||||
@ -46,19 +46,19 @@ The following is an example of the v.2 version of the Enterprise Mode schema.
|
||||
|
||||
```xml
|
||||
<site-list version="205">
|
||||
<!--- File creation header --->
|
||||
<!-- File creation header -->
|
||||
<created-by>
|
||||
<tool>EnterpriseSitelistManager</tool>
|
||||
<version>10240</version>
|
||||
<date-created>20150728.135021</date-created>
|
||||
</created-by>
|
||||
<!--- Begin Site List --->
|
||||
<!-- Begin Site List -->
|
||||
<site url="www.cpandl.com">
|
||||
<compat-mode>IE8Enterprise</compat-mode>
|
||||
<open-in>MSEdge</open-in>
|
||||
</site>
|
||||
<site url="www.woodgrovebank.com">
|
||||
<compat-mode>default</compat-mode>
|
||||
<compat-mode>Default</compat-mode>
|
||||
<open-in>IE11</open-in>
|
||||
</site>
|
||||
<site url="adatum.com">
|
||||
@ -66,14 +66,15 @@ The following is an example of the v.2 version of the Enterprise Mode schema.
|
||||
<open-in>IE11</open-in>
|
||||
</site>
|
||||
<site url="contoso.com">
|
||||
<compat-mode>default</compat-mode>
|
||||
<compat-mode>Default</compat-mode>
|
||||
<open-in>IE11</open-in>
|
||||
</site>
|
||||
<site url="relecloud.com"/>
|
||||
<compat-mode>default</compat-mode>
|
||||
<open-in>none</open-in>
|
||||
<compat-mode>Default</compat-mode>
|
||||
<open-in>None</open-in>
|
||||
<site url="relecloud.com/about">
|
||||
<compat-mode>IE8Enterprise"</compat-mode>
|
||||
<open-in>None</open-in>
|
||||
</site>
|
||||
<site url="contoso.com/travel">
|
||||
<compat-mode>IE7</compat-mode>
|
||||
@ -232,26 +233,26 @@ These v.1 version schema attributes have been deprecated in the v.2 version of t
|
||||
<table>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th>Deprecated attribute</th>
|
||||
<th>New attribute</th>
|
||||
<th>Deprecated element/attribute</th>
|
||||
<th>New element</th>
|
||||
<th>Replacement example</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><forceCompatView></td>
|
||||
<td>forceCompatView</td>
|
||||
<td><compat-mode></td>
|
||||
<td>Replace <forceCompatView="true"> with <compat-mode>IE7Enterprise</compat-mode></td>
|
||||
<td>Replace forceCompatView="true" with <compat-mode>IE7Enterprise</compat-mode></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><docMode></td>
|
||||
<td>docMode</td>
|
||||
<td><compat-mode></td>
|
||||
<td>Replace <docMode="IE5"> with <compat-mode>IE5</compat-mode></td>
|
||||
<td>Replace docMode="IE5" with <compat-mode>IE5</compat-mode></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><doNotTransition></td>
|
||||
<td>doNotTransition</td>
|
||||
<td><open-in></td>
|
||||
<td>Replace <doNotTransition="true"> with <open-in>none</open-in></td>
|
||||
<td>Replace doNotTransition="true" with <open-in>none</open-in></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><domain> and <path></td>
|
||||
@ -259,25 +260,28 @@ These v.1 version schema attributes have been deprecated in the v.2 version of t
|
||||
<td>Replace:
|
||||
<pre class="syntax">
|
||||
<emie>
|
||||
<domain exclude="false">contoso.com</domain>
|
||||
<domain>contoso.com</domain>
|
||||
</emie></pre>
|
||||
With:
|
||||
<pre class="syntax">
|
||||
<site url="contoso.com"/>
|
||||
<compat-mode>IE8Enterprise</compat-mode>
|
||||
<open-in>IE11</open-in>
|
||||
</site></pre>
|
||||
<b>-AND-</b><p>
|
||||
Replace:
|
||||
<pre class="syntax">
|
||||
<emie>
|
||||
<domain exclude="true">contoso.com
|
||||
<path exclude="false" forceCompatView="true">/about</path>
|
||||
<domain exclude="true" doNotTransition="true">
|
||||
contoso.com
|
||||
<path forceCompatView="true">/about</path>
|
||||
</domain>
|
||||
</emie></pre>
|
||||
With:
|
||||
<pre class="syntax">
|
||||
<site url="contoso.com/about">
|
||||
<compat-mode>IE7Enterprise</compat-mode>
|
||||
<open-in>IE11</open-in>
|
||||
</site></pre></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -71,19 +71,19 @@ This is a view of the [raw EMIE v2 schema.xml file](https://gist.github.com/kypf
|
||||
|
||||
```xml
|
||||
<site-list version="205">
|
||||
<!--- File creation header --->
|
||||
<!-- File creation header -->
|
||||
<created-by>
|
||||
<tool>EnterpriseSiteListManager</tool>
|
||||
<version>10586</version>
|
||||
<date-created>20150728.135021</date-created>
|
||||
</created-by>
|
||||
<!--- Begin Site List --->
|
||||
<!-- Begin Site List -->
|
||||
<site url="www.cpandl.com">
|
||||
<compat-mode>IE8Enterprise</compat-mode>
|
||||
<open-in>IE11</open-in>
|
||||
</site>
|
||||
<site url="www.woodgrovebank.com">
|
||||
<compat-mode>default</compat-mode>
|
||||
<compat-mode>Default</compat-mode>
|
||||
<open-in>IE11</open-in>
|
||||
</site>
|
||||
<site url="adatum.com">
|
||||
@ -92,8 +92,8 @@ This is a view of the [raw EMIE v2 schema.xml file](https://gist.github.com/kypf
|
||||
</site>
|
||||
<site url="relecloud.com"/>
|
||||
<!-- default for self-closing XML tag is
|
||||
<compat-mode>default</compat-mode>
|
||||
<open-in>none</open-in>
|
||||
<compat-mode>Default</compat-mode>
|
||||
<open-in>None</open-in>
|
||||
-->
|
||||
<site url="relecloud.com/products">
|
||||
<compat-mode>IE8Enterprise"</compat-mode>
|
||||
|
||||
@ -14,11 +14,11 @@ ms.sitesec: library
|
||||
ms.date: 07/27/2017
|
||||
---
|
||||
|
||||
# IExpress Wizard command-line options
|
||||
|
||||
**Applies to:**
|
||||
- Windows Server 2008 R2 with SP1
|
||||
|
||||
# IExpress Wizard command-line options
|
||||
Use command-line options with the IExpress Wizard (IExpress.exe) to control your Internet Explorer custom browser package extraction process.
|
||||
|
||||
These command-line options work with IExpress:<br>
|
||||
|
||||
@ -16,7 +16,7 @@
|
||||
## [Install localized version of HoloLens (1st gen)](hololens1-install-localized.md)
|
||||
## [Getting around HoloLens (1st gen)](hololens1-basic-usage.md)
|
||||
|
||||
# Get started with HoloLens in commercial environments
|
||||
# HoloLens in commercial environments
|
||||
## [Commercial feature overview](hololens-commercial-features.md)
|
||||
## [Deployment planning](hololens-requirements.md)
|
||||
## [Unlock Windows Holographic for Business features](hololens1-upgrade-enterprise.md)
|
||||
@ -55,7 +55,6 @@
|
||||
# Update, troubleshoot, or recover HoloLens
|
||||
## [Update, troubleshoot, or recover HoloLens](hololens-management-overview.md)
|
||||
## [Update HoloLens](hololens-update-hololens.md)
|
||||
## [Manage updates on many HoloLens](hololens-updates.md)
|
||||
## [Restart, reset, or recover](hololens-recovery.md)
|
||||
## [Troubleshoot HoloLens](hololens-troubleshooting.md)
|
||||
## [Known issues](hololens-known-issues.md)
|
||||
|
||||
@ -105,13 +105,12 @@ Here are some things you can try saying (remember to say "Hey Cortana" first).
|
||||
- Take a picture.
|
||||
- Start recording. (Starts recording a video.)
|
||||
- Stop recording. (Stops recording a video.)
|
||||
- Call <*contact*>. (Requires Skype.)
|
||||
- What time is it?
|
||||
- Show me the latest NBA scores.
|
||||
- How much battery do I have left?
|
||||
- Tell me a joke.
|
||||
|
||||
Some Cortana features that you're used to from Windows on your PC or phone (for example, reminders and notifications) aren't supported in Microsoft HoloLens Development Edition. Cortana on HoloLens is English-only, and the Cortana experience may vary from one region to another.
|
||||
Some Cortana features that you're used to from Windows on your PC or phone (for example, reminders and notifications) aren't supported in Microsoft HoloLens, and the Cortana experience may vary from one region to another.
|
||||
|
||||
### Turn Cortana off
|
||||
|
||||
|
||||
@ -117,5 +117,5 @@ If someone else is going to be using your HoloLens, they should run the Calibrat
|
||||
|
||||
## See also
|
||||
|
||||
- [Spatial mapping design](https://docs.microsoft.com/windows/mixed-reality/spatial-mapping-design)
|
||||
- [Spatial mapping design](https://docs.microsoft.com/windows/mixed-reality/spatial-mapping)
|
||||
- [Holograms](https://docs.microsoft.com/windows/mixed-reality/hologram)
|
||||
|
||||
@ -55,7 +55,7 @@ If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-using-microsoft-intune-or-
|
||||
|
||||
### Start layout file for MDM (Intune and others)
|
||||
|
||||
Save the following sample as an XML file. You will select this file when you configure the kiosk in Microsoft Intune (or in another MDM service that provides a kiosk profile).
|
||||
Save the following sample as an XML file. You can use this file when you configure the multi-app kiosk in Microsoft Intune (or in another MDM service that provides a kiosk profile).
|
||||
|
||||
>[!NOTE]
|
||||
>If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, use the [Start layout instructions for a provisioning package](#start-layout-for-a-provisioning-package).
|
||||
|
||||
@ -8,7 +8,7 @@ ms.prod: hololens
|
||||
ms.sitesec: library
|
||||
ms.topic: article
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 10/14/2019
|
||||
ms.date: 12/02/2019
|
||||
audience: ITPro
|
||||
appliesto:
|
||||
- HoloLens 1
|
||||
@ -19,6 +19,8 @@ appliesto:
|
||||
# HoloLens Release Notes
|
||||
|
||||
## HoloLens 2
|
||||
> [!Note]
|
||||
> HoloLens Emulator Release Notes can be found [here](https://docs.microsoft.com/windows/mixed-reality/hololens-emulator-archive).
|
||||
|
||||
### November Update - build 18362.1039
|
||||
|
||||
|
||||
@ -56,6 +56,8 @@
|
||||
## Overview
|
||||
### [What's new in Windows 10, version 1703 for Surface Hub?](surfacehub-whats-new-1703.md)
|
||||
### [Operating system essentials (Surface Hub)](differences-between-surface-hub-and-windows-10-enterprise.md)
|
||||
### [Technical information for 55” Microsoft Surface Hub](surface-hub-technical-55.md)
|
||||
### [Technical information for 84” Microsoft Surface Hub](surface-hub-technical-84.md)
|
||||
|
||||
## Plan
|
||||
### [Prepare your environment for Microsoft Surface Hub](prepare-your-environment-for-surface-hub.md)
|
||||
@ -111,7 +113,6 @@
|
||||
## Troubleshoot
|
||||
### [Using the Surface Hub Recovery Tool](surface-hub-recovery-tool.md)
|
||||
### [Surface Hub SSD replacement](surface-hub-ssd-replacement.md)
|
||||
|
||||
### [Top support solutions for Surface Hub](support-solutions-surface-hub.md)
|
||||
### [Troubleshoot Microsoft Surface Hub](troubleshoot-surface-hub.md)
|
||||
### [Surface Hub Update History](surface-hub-update-history.md)
|
||||
@ -124,6 +125,4 @@
|
||||
### [Surface Hub may install updates and restart outside maintenance hours](surface-hub-installs-updates-and-restarts-outside-maintenance-hours.md)
|
||||
### [General Data Privacy Regulation and Surface Hub](general-data-privacy-regulation-and-surface-hub.md)
|
||||
### [Useful downloads for Surface Hub administrators](surface-hub-downloads.md)
|
||||
### [Technical information for 55” Microsoft Surface Hub](surface-hub-technical-55.md)
|
||||
### [Technical information for 84” Microsoft Surface Hub](surface-hub-technical-84.md)
|
||||
### [Change history for Surface Hub](change-history-surface-hub.md)
|
||||
|
||||
@ -15,130 +15,131 @@ ms.localizationpriority: medium
|
||||
---
|
||||
|
||||
# Hybrid deployment (Surface Hub)
|
||||
A hybrid deployment requires special processing to set up a device account for your Microsoft Surface Hub. If you’re using a hybrid deployment, in which your organization has a mix of services, with some hosted on-premises and some hosted online, then your configuration will depend on where each service is hosted. This topic covers hybrid deployments for [Exchange hosted on-premises](#exchange-on-prem), [Exchange hosted online](#exchange-online), Skype for Business on-premises, Skype for Business online, and Skype for Business hybrid. Because there are so many different variations in this type of deployment, it's not possible to provide detailed instructions for all of them. The following process will work for many configurations. If the process isn't right for your setup, we recommend that you use PowerShell (see [Appendix: PowerShell](appendix-a-powershell-scripts-for-surface-hub.md)) to achieve the same end result as documented here, and for other deployment options. You should then use the provided Powershell script to verify your Surface Hub setup. (See [Account Verification Script](appendix-a-powershell-scripts-for-surface-hub.md#acct-verification-ps-scripts).)
|
||||
|
||||
>[!NOTE]
|
||||
>In an Exchange hybrid environment, follow the steps for [Exchange on-premises](#exchange-on-prem). To move Exchange objects to Office 365, use the [New-MoveRequest](https://docs.microsoft.com/powershell/module/exchange/move-and-migration/new-moverequest?view=exchange-ps) cmdlet.
|
||||
A hybrid deployment requires special processing to set up a device account for your Microsoft Surface Hub. If you’re using a hybrid deployment, in which your organization has a mix of services, with some hosted on-premises and some hosted online, then your configuration will depend on where each service is hosted. This topic covers hybrid deployments for [Exchange hosted on-premises](#exchange-on-premises), [Exchange hosted online](#exchange-online), Skype for Business on-premises, Skype for Business online, and Skype for Business hybrid. Because there are so many different variations in this type of deployment, it's not possible to provide detailed instructions for all of them. The following process will work for many configurations. If the process isn't right for your setup, we recommend that you use PowerShell (see [Appendix: PowerShell](appendix-a-powershell-scripts-for-surface-hub.md)) to achieve the same end result as documented here, and for other deployment options. You should then use the provided Powershell script to verify your Surface Hub setup. (See [Account Verification Script](appendix-a-powershell-scripts-for-surface-hub.md#acct-verification-ps-scripts).)
|
||||
|
||||
> [!NOTE]
|
||||
> In an Exchange hybrid environment, follow the steps for [Exchange on-premises](#exchange-on-premises). To move Exchange objects to Office 365, use the [New-MoveRequest](https://docs.microsoft.com/powershell/module/exchange/move-and-migration/new-moverequest?view=exchange-ps) cmdlet.
|
||||
|
||||
<span id="exchange-on-prem" />
|
||||
## Exchange on-premises
|
||||
|
||||
Use this procedure if you use Exchange on-premises.
|
||||
|
||||
1. For this procedure, you'll be using AD admin tools to add an email address for your on-premises domain account. This account will be synced to Office 365.
|
||||
1. For this procedure, you'll be using AD admin tools to add an email address for your on-premises domain account. This account will be synced to Office 365.
|
||||
|
||||
- In **Active Directory Users and Computers** AD tool, right-click on the folder or Organizational Unit that your Surface Hub accounts will be created in, click **New**, and **User**.
|
||||
- Type the display name from the previous cmdlet into the **Full name** box, and the alias into the **User logon name** box. Click **Next**.<p>
|
||||
|
||||
|
||||
- In **Active Directory Users and Computers** AD tool, right-click on the folder or Organizational Unit that your Surface Hub accounts will be created in, click **New**, and **User**.
|
||||
- Type the display name from the previous cmdlet into the **Full name** box, and the alias into the **User logon name** box. Click **Next**.<p>
|
||||
|
||||
- Type the password for this account. You'll need to retype it for verification. Make sure the **Password never expires** checkbox is the only option selected.
|
||||
|
||||
|
||||
>**Important** Selecting **Password never expires** is a requirement for Skype for Business on the Surface Hub. Your domain rules may prohibit passwords that don't expire. If so, you'll need to create an exception for each Surface Hub device account.
|
||||
- Type the password for this account. You'll need to retype it for verification. Make sure the **Password never expires** checkbox is the only option selected.
|
||||
|
||||
|
||||
|
||||
- Click **Finish** to create the account.
|
||||
> **Important** Selecting **Password never expires** is a requirement for Skype for Business on the Surface Hub. Your domain rules may prohibit passwords that don't expire. If so, you'll need to create an exception for each Surface Hub device account.
|
||||
|
||||
|
||||
|
||||
|
||||
- Click **Finish** to create the account.
|
||||
|
||||
|
||||
|
||||
2. Enable the remote mailbox.
|
||||
2. Enable the remote mailbox.
|
||||
|
||||
Open your on-premises Exchange Management Shell with administrator permissions, and run this cmdlet.
|
||||
Open your on-premises Exchange Management Shell with administrator permissions, and run this cmdlet.
|
||||
|
||||
```PowerShell
|
||||
Enable-RemoteMailbox 'HUB01@contoso.com' -RemoteRoutingAddress 'HUB01@contoso.com' -Room
|
||||
```
|
||||
>[!NOTE]
|
||||
>If you don't have an on-premises Exchange environment to run this cmdlet, you can make the same changes directly to the Active Directory object for the account.
|
||||
>
|
||||
>msExchRemoteRecipientType = 33
|
||||
>
|
||||
>msExchRecipientDisplayType = -2147481850
|
||||
>
|
||||
>msExchRecipientTypeDetails = 8589934592
|
||||
|
||||
3. After you've created the account, run a directory synchronization. When it's complete, go to the users page in your Microsoft 365 admin center and verify that the account created in the previous steps has merged to online.
|
||||
|
||||
4. Connect to Microsoft Exchange Online and set some properties for the account in Office 365.
|
||||
```PowerShell
|
||||
Enable-RemoteMailbox 'HUB01@contoso.com' -RemoteRoutingAddress 'HUB01@contoso.com' -Room
|
||||
```
|
||||
|
||||
Start a remote PowerShell session on a PC and connect to Microsoft Exchange. Be sure you have the right permissions set to run the associated cmdlets.
|
||||
> [!NOTE]
|
||||
> If you don't have an on-premises Exchange environment to run this cmdlet, you can make the same changes directly to the Active Directory object for the account.
|
||||
>
|
||||
> msExchRemoteRecipientType = 33
|
||||
>
|
||||
> msExchRecipientDisplayType = -2147481850
|
||||
>
|
||||
> msExchRecipientTypeDetails = 8589934592
|
||||
|
||||
The next steps will be run on your Office 365 tenant.
|
||||
3. After you've created the account, run a directory synchronization. When it's complete, go to the users page in your Microsoft 365 admin center and verify that the account created in the previous steps has merged to online.
|
||||
|
||||
```PowerShell
|
||||
Set-ExecutionPolicy RemoteSigned
|
||||
$cred=Get-Credential -Message "Please use your Office 365 admin credentials"
|
||||
$sess= New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri 'https://ps.outlook.com/powershell' -Credential $cred -Authentication Basic -AllowRedirection
|
||||
Import-PSSession $sess
|
||||
```
|
||||
4. Connect to Microsoft Exchange Online and set some properties for the account in Office 365.
|
||||
|
||||
5. Create a new Exchange ActiveSync policy, or use a compatible existing policy.
|
||||
Start a remote PowerShell session on a PC and connect to Microsoft Exchange. Be sure you have the right permissions set to run the associated cmdlets.
|
||||
|
||||
After setting up the mailbox, you will need to either create a new Exchange ActiveSync policy or use a compatible existing policy.
|
||||
|
||||
Surface Hubs are only compatible with device accounts that have an ActiveSync policy where the **PasswordEnabled** property is set to False. If this isn’t set properly, then Exchange services on the Surface Hub (mail, calendar, and joining meetings), will not be enabled.
|
||||
The next steps will be run on your Office 365 tenant.
|
||||
|
||||
If you haven’t created a compatible policy yet, use the following cmdlet—-this one creates a policy called "Surface Hubs". Once it’s created, you can apply the same policy to other device accounts.
|
||||
```PowerShell
|
||||
Set-ExecutionPolicy RemoteSigned
|
||||
$cred=Get-Credential -Message "Please use your Office 365 admin credentials"
|
||||
$sess= New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri 'https://ps.outlook.com/powershell' -Credential $cred -Authentication Basic -AllowRedirection
|
||||
Import-PSSession $sess
|
||||
```
|
||||
|
||||
```PowerShell
|
||||
$easPolicy = New-MobileDeviceMailboxPolicy -Name “SurfaceHubs” -PasswordEnabled $false
|
||||
```
|
||||
5. Create a new Exchange ActiveSync policy, or use a compatible existing policy.
|
||||
|
||||
Once you have a compatible policy, then you will need to apply the policy to the device account.
|
||||
After setting up the mailbox, you will need to either create a new Exchange ActiveSync policy or use a compatible existing policy.
|
||||
|
||||
```PowerShell
|
||||
Set-CASMailbox 'HUB01@contoso.com' -ActiveSyncMailboxPolicy $easPolicy.id
|
||||
```
|
||||
Surface Hubs are only compatible with device accounts that have an ActiveSync policy where the **PasswordEnabled** property is set to False. If this isn’t set properly, then Exchange services on the Surface Hub (mail, calendar, and joining meetings), will not be enabled.
|
||||
|
||||
6. Set Exchange properties.
|
||||
If you haven’t created a compatible policy yet, use the following cmdlet—this one creates a policy called "Surface Hubs". Once it’s created, you can apply the same policy to other device accounts.
|
||||
|
||||
Setting Exchange properties on the device account to improve the meeting experience. You can see which properties need to be set in the [Exchange properties](exchange-properties-for-surface-hub-device-accounts.md) section.
|
||||
```PowerShell
|
||||
$easPolicy = New-MobileDeviceMailboxPolicy -Name “SurfaceHubs” -PasswordEnabled $false
|
||||
```
|
||||
|
||||
```PowerShell
|
||||
Set-CalendarProcessing -Identity 'HUB01@contoso.com' -AutomateProcessing AutoAccept -AddOrganizerToSubject $false –AllowConflicts $false –DeleteComments $false -DeleteSubject $false -RemovePrivateProperty $false
|
||||
Set-CalendarProcessing -Identity 'HUB01@contoso.com' -AddAdditionalResponse $true -AdditionalResponse 'This is a Surface Hub room!'
|
||||
```
|
||||
Once you have a compatible policy, you will need to apply the policy to the device account.
|
||||
|
||||
7. Connect to Azure AD.
|
||||
```PowerShell
|
||||
Set-CASMailbox 'HUB01@contoso.com' -ActiveSyncMailboxPolicy $easPolicy.id
|
||||
```
|
||||
|
||||
You first need to install Azure AD module for PowerShell version 2. In an elevated powershell prompt run the following command :
|
||||
```PowerShell
|
||||
Install-Module -Name AzureAD
|
||||
```
|
||||
|
||||
You need to connect to Azure AD to apply some account settings. You can run this cmdlet to connect.
|
||||
6. Set Exchange properties.
|
||||
|
||||
```PowerShell
|
||||
Import-Module AzureAD
|
||||
Connect-AzureAD -Credential $cred
|
||||
```
|
||||
8. Assign an Office 365 license.
|
||||
Setting Exchange properties on the device account to improve the meeting experience. You can see which properties need to be set in the [Exchange properties](exchange-properties-for-surface-hub-device-accounts.md) section.
|
||||
|
||||
The device account needs to have a valid Office 365 (O365) license, or Exchange and Skype for Business will not work. If you have the license, you need to assign a usage location to your device account—this determines what license SKUs are available for your account.
|
||||
|
||||
You can use `Get-AzureADSubscribedSku` to retrieve a list of available SKUs for your O365 tenant.
|
||||
```PowerShell
|
||||
Set-CalendarProcessing -Identity 'HUB01@contoso.com' -AutomateProcessing AutoAccept -AddOrganizerToSubject $false –AllowConflicts $false –DeleteComments $false -DeleteSubject $false -RemovePrivateProperty $false
|
||||
Set-CalendarProcessing -Identity 'HUB01@contoso.com' -AddAdditionalResponse $true -AdditionalResponse 'This is a Surface Hub room!'
|
||||
```
|
||||
|
||||
Once you list out the SKUs, you'll need to assign the SkuId you want to the `$License.SkuId` variable.
|
||||
7. Connect to Azure AD.
|
||||
|
||||
```PowerShell
|
||||
Set-AzureADUser -ObjectId "HUB01@contoso.com" -UsageLocation "US"
|
||||
|
||||
Get-AzureADSubscribedSku | Select Sku*,*Units
|
||||
$License = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicense
|
||||
$License.SkuId = SkuId You selected
|
||||
|
||||
$AssignedLicenses = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicenses
|
||||
$AssignedLicenses.AddLicenses = $License
|
||||
$AssignedLicenses.RemoveLicenses = @()
|
||||
|
||||
Set-AzureADUserLicense -ObjectId "HUB01@contoso.com" -AssignedLicenses $AssignedLicenses
|
||||
```
|
||||
You first need to install Azure AD module for PowerShell version 2. In an elevated PowerShell prompt, run the following command:
|
||||
|
||||
```PowerShell
|
||||
Install-Module -Name AzureAD
|
||||
```
|
||||
|
||||
You need to connect to Azure AD to apply some account settings. You can run this cmdlet to connect.
|
||||
|
||||
```PowerShell
|
||||
Import-Module AzureAD
|
||||
Connect-AzureAD -Credential $cred
|
||||
```
|
||||
|
||||
8. Assign an Office 365 license.
|
||||
|
||||
The device account needs to have a valid Office 365 (O365) license, or Exchange and Skype for Business will not work. If you have the license, you need to assign a usage location to your device account—this determines what license SKUs are available for your account.
|
||||
|
||||
You can use `Get-AzureADSubscribedSku` to retrieve a list of available SKUs for your O365 tenant.
|
||||
|
||||
Once you list out the SKUs, you'll need to assign the SkuId you want to the `$License.SkuId` variable.
|
||||
|
||||
```PowerShell
|
||||
Set-AzureADUser -ObjectId "HUB01@contoso.com" -UsageLocation "US"
|
||||
|
||||
Get-AzureADSubscribedSku | Select Sku*,*Units
|
||||
$License = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicense
|
||||
$License.SkuId = SkuId You selected
|
||||
|
||||
$AssignedLicenses = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicenses
|
||||
$AssignedLicenses.AddLicenses = $License
|
||||
$AssignedLicenses.RemoveLicenses = @()
|
||||
|
||||
Set-AzureADUserLicense -ObjectId "HUB01@contoso.com" -AssignedLicenses $AssignedLicenses
|
||||
```
|
||||
|
||||
Next, you enable the device account with [Skype for Business Online](#skype-for-business-online), [Skype for Business on-premises](#skype-for-business-on-premises), or [Skype for Business hybrid](#skype-for-business-hybrid).
|
||||
|
||||
<span id="sfb-online"/>
|
||||
### Skype for Business Online
|
||||
|
||||
To enable Skype for Business online, your tenant users must have Exchange mailboxes (at least one Exchange mailbox in the tenant is required). The following table explains which plans or additional services you need.
|
||||
@ -149,7 +150,7 @@ To enable Skype for Business online, your tenant users must have Exchange mailbo
|
||||
| Initiate an ad-hoc meeting | Skype for Business Standalone Plan 2 | E 1, 3, 4, or 5 | Skype for Business Server Standard CAL or Enterprise CAL |
|
||||
| Initiate an ad-hoc meeting and dial out from a meeting to phone numbers | Skype for Business Standalone Plan 2 with Audio Conferencing</br></br>**Note** PSTN consumption billing is optional | E1 or E3 with Audio Conferencing, or E5| Skype for Business Server Standard CAL or Enterprise CAL |
|
||||
| Give the room a phone number and make or receive calls from the room or join a dial-in conference using a phone number | Skype for Business Standalone Plan 2 with Phone System and a PSTN Voice Calling plan | E1 or E3 with Phone System and a PSTN Voice Calling plan, or E5 | Skype for Business Server Standard CAL or Plus CAL |
|
||||
|
||||
|
||||
The following table lists the Office 365 plans and Skype for Business options.
|
||||
|
||||
| O365 Plan | Skype for Business | Phone System | Audio Conferencing | Calling Plans |
|
||||
@ -162,42 +163,42 @@ The following table lists the Office 365 plans and Skype for Business options.
|
||||
|
||||
1. Start by creating a remote PowerShell session from a PC to the Skype for Business online environment.
|
||||
|
||||
```PowerShell
|
||||
Import-Module SkypeOnlineConnector
|
||||
$cssess=New-CsOnlineSession -Credential $cred
|
||||
Import-PSSession $cssess -AllowClobber
|
||||
```
|
||||
|
||||
```PowerShell
|
||||
Import-Module SkypeOnlineConnector
|
||||
$cssess=New-CsOnlineSession -Credential $cred
|
||||
Import-PSSession $cssess -AllowClobber
|
||||
```
|
||||
|
||||
2. To enable your Surface Hub account for Skype for Business Server, run this cmdlet:
|
||||
|
||||
```PowerShell
|
||||
Enable-CsMeetingRoom -Identity 'HUB01@contoso.com' -RegistrarPool 'sippoolbl20a04.infra.lync.com' -SipAddressType UserPrincipalName
|
||||
```
|
||||
|
||||
If you aren't sure what value to use for the `RegistrarPool` parameter in your environment, you can get the value from an existing Skype for Business user using this cmdlet:
|
||||
```PowerShell
|
||||
Enable-CsMeetingRoom -Identity 'HUB01@contoso.com' -RegistrarPool 'sippoolbl20a04.infra.lync.com' -SipAddressType UserPrincipalName
|
||||
```
|
||||
|
||||
```PowerShell
|
||||
Get-CsOnlineUser -Identity ‘HUB01@contoso.com’| fl *registrarpool*
|
||||
```
|
||||
If you aren't sure what value to use for the `RegistrarPool` parameter in your environment, you can get the value from an existing Skype for Business user using this cmdlet:
|
||||
|
||||
```PowerShell
|
||||
Get-CsOnlineUser -Identity ‘HUB01@contoso.com’| fl *registrarpool*
|
||||
```
|
||||
|
||||
3. Assign Skype for Business license to your Surface Hub account.
|
||||
|
||||
Once you've completed the preceding steps to enable your Surface Hub account in Skype for Business Online, you need to assign a license to the Surface Hub. Using the O365 administrative portal, assign either a Skype for Business Online (Plan 2) or a Skype for Business Online (Plan 3) to the device.
|
||||
|
||||
- Login as a tenant administrator, open the O365 Administrative Portal, and click on the Admin app.
|
||||
|
||||
- Click on **Users and Groups** and then **Add users, reset passwords, and more**.
|
||||
|
||||
- Click the Surface Hub account, and then click the pen icon to edit the account information.
|
||||
|
||||
- Click **Licenses**.
|
||||
|
||||
- In **Assign licenses**, select Skype for Business (Plan 1) or Skype for Business (Plan 2), depending on your licensing and Enterprise Voice requirements. You'll have to use a Plan 2 license if you want to use Enterprise Voice on your Surface Hub.
|
||||
|
||||
- Click **Save**.
|
||||
Once you've completed the preceding steps to enable your Surface Hub account in Skype for Business Online, you need to assign a license to the Surface Hub. Using the O365 administrative portal, assign either a Skype for Business Online (Plan 2) or a Skype for Business Online (Plan 3) license to the device.
|
||||
|
||||
>[!NOTE]
|
||||
>You can also use the Windows Azure Active Directory Module for Windows Powershell to run the cmdlets needed to assign one of these licenses, but that's not covered here.
|
||||
- Login as a tenant administrator, open the O365 Administrative Portal, and click on the Admin app.
|
||||
|
||||
- Click on **Users and Groups** and then **Add users, reset passwords, and more**.
|
||||
|
||||
- Click the Surface Hub account, and then click the pen icon to edit the account information.
|
||||
|
||||
- Click **Licenses**.
|
||||
|
||||
- In **Assign licenses**, select Skype for Business (Plan 1) or Skype for Business (Plan 2), depending on your licensing and Enterprise Voice requirements. You'll have to use a Plan 2 license if you want to use Enterprise Voice on your Surface Hub.
|
||||
|
||||
- Click **Save**.
|
||||
|
||||
> [!NOTE]
|
||||
> You can also use the Windows Azure Active Directory Module for Windows Powershell to run the cmdlets needed to assign one of these licenses, but that's not covered here.
|
||||
|
||||
For validation, you should be able to use any Skype for Business client (PC, Android, etc.) to sign in to this account.
|
||||
|
||||
@ -205,7 +206,7 @@ For validation, you should be able to use any Skype for Business client (PC, And
|
||||
|
||||
To run this cmdlet, you will need to connect to one of the Skype front-ends. Open the Skype PowerShell and run:
|
||||
|
||||
```
|
||||
```PowerShell
|
||||
Enable-CsMeetingRoom -Identity 'HUB01@contoso.com' -RegistrarPool registrarpoolfqdn -SipAddressType UserPrincipalName
|
||||
```
|
||||
|
||||
@ -217,181 +218,181 @@ The Surface Hub requires a Skype account of the type `meetingroom`, while a norm
|
||||
|
||||
In Skype for Business Server 2015 hybrid environment, any user that you want in Skype for Business Online must first be created in the on-premises deployment, so that the user account is created in Active Directory Domain Services. You can then move the user to Skype for Business Online. The move of a user account from on-premises to online is done via the [Move-CsUser](https://technet.microsoft.com/library/gg398528.aspx) cmdlet. To move a Csmeetingroom object, use the [Move-CsMeetingRoom](https://technet.microsoft.com/library/jj204889.aspx?f=255&mspperror=-2147217396) cmdlet.
|
||||
|
||||
>[!NOTE]
|
||||
>To use the Move-CsMeetingRoom cmdlet, you must have installed [the May 2017 cumulative update 6.0.9319.281 for Skype for Business Server 2015](https://support.microsoft.com/help/4020991/enables-the-move-csmeetingroom-cmdlet-to-move-a-meeting-room-from-on-p) or [the July 2017 cumulative update 5.0.8308.992 for Lync Server 2013](https://support.microsoft.com/help/4034279/enables-the-move-csmeetingroom-cmdlet-to-move-a-meeting-room-from-on-p).
|
||||
> [!NOTE]
|
||||
> To use the Move-CsMeetingRoom cmdlet, you must have installed [the May 2017 cumulative update 6.0.9319.281 for Skype for Business Server 2015](https://support.microsoft.com/help/4020991/enables-the-move-csmeetingroom-cmdlet-to-move-a-meeting-room-from-on-p) or [the July 2017 cumulative update 5.0.8308.992 for Lync Server 2013](https://support.microsoft.com/help/4034279/enables-the-move-csmeetingroom-cmdlet-to-move-a-meeting-room-from-on-p).
|
||||
|
||||
|
||||
## Exchange online
|
||||
|
||||
Use this procedure if you use Exchange online.
|
||||
|
||||
1. Create an email account in Office 365.
|
||||
1. Create an email account in Office 365.
|
||||
|
||||
Start a remote PowerShell session on a PC and connect to Exchange. Be sure you have the right permissions set to run the associated cmdlets.
|
||||
Start a remote PowerShell session on a PC and connect to Exchange. Be sure you have the right permissions set to run the associated cmdlets.
|
||||
|
||||
```PowerShell
|
||||
Set-ExecutionPolicy RemoteSigned
|
||||
$cred=Get-Credential -Message "Please use your Office 365 admin credentials"
|
||||
$sess= New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/PowerShell-liveid/ -Credential $cred -Authentication Basic -AllowRedirection
|
||||
Import-PSSession $sess
|
||||
```
|
||||
```PowerShell
|
||||
Set-ExecutionPolicy RemoteSigned
|
||||
$cred=Get-Credential -Message "Please use your Office 365 admin credentials"
|
||||
$sess= New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/PowerShell-liveid/ -Credential $cred -Authentication Basic -AllowRedirection
|
||||
Import-PSSession $sess
|
||||
```
|
||||
|
||||
2. Set up mailbox.
|
||||
2. Set up a mailbox.
|
||||
|
||||
After establishing a session, you’ll either create a new mailbox and enable it as a RoomMailboxAccount, or change the settings for an existing room mailbox. This will allow the account to authenticate into the Surface Hub.
|
||||
After establishing a session, you’ll either create a new mailbox and enable it as a RoomMailboxAccount, or change the settings for an existing room mailbox. This will allow the account to authenticate into the Surface Hub.
|
||||
|
||||
If you're changing an existing resource mailbox:
|
||||
If you're changing an existing resource mailbox:
|
||||
|
||||
```PowerShell
|
||||
Set-Mailbox -Identity 'HUB01' -EnableRoomMailboxAccount $true -RoomMailboxPassword (ConvertTo-SecureString -String <password> -AsPlainText -Force)
|
||||
```
|
||||
```PowerShell
|
||||
Set-Mailbox -Identity 'HUB01' -EnableRoomMailboxAccount $true -RoomMailboxPassword (ConvertTo-SecureString -String <password> -AsPlainText -Force)
|
||||
```
|
||||
|
||||
If you’re creating a new resource mailbox:
|
||||
If you’re creating a new resource mailbox:
|
||||
|
||||
```PowerShell
|
||||
New-Mailbox -MicrosoftOnlineServicesID 'HUB01@contoso.com' -Alias HUB01 -Name "Hub-01" -Room -EnableRoomMailboxAccount $true -RoomMailboxPassword (ConvertTo-SecureString -String <password> -AsPlainText -Force)
|
||||
```
|
||||
```PowerShell
|
||||
New-Mailbox -MicrosoftOnlineServicesID 'HUB01@contoso.com' -Alias HUB01 -Name "Hub-01" -Room -EnableRoomMailboxAccount $true -RoomMailboxPassword (ConvertTo-SecureString -String <password> -AsPlainText -Force)
|
||||
```
|
||||
|
||||
3. Create Exchange ActiveSync policy.
|
||||
3. Create Exchange ActiveSync policy.
|
||||
|
||||
After setting up the mailbox, you will need to either create a new Exchange ActiveSync policy, or use a compatible existing policy.
|
||||
After setting up the mailbox, you will need to either create a new Exchange ActiveSync policy, or use a compatible existing policy.
|
||||
|
||||
Surface Hubs are only compatible with device accounts that have an ActiveSync policy where the **PasswordEnabled** property is set to False. If this isn’t set properly, then Exchange services on the Surface Hub (mail, calendar, and joining meetings), will not be enabled.
|
||||
Surface Hubs are only compatible with device accounts that have an ActiveSync policy where the **PasswordEnabled** property is set to False. If this isn’t set properly, Exchange services on the Surface Hub (mail, calendar, and joining meetings) will not be enabled.
|
||||
|
||||
If you haven’t created a compatible policy yet, use the following cmdlet—this one creates a policy called "Surface Hubs". Once it’s created, you can apply the same policy to other device accounts.
|
||||
If you haven’t created a compatible policy yet, use the following cmdlet—this one creates a policy called "Surface Hubs". Once it’s created, you can apply the same policy to other device accounts.
|
||||
|
||||
```PowerShell
|
||||
$easPolicy = New-MobileDeviceMailboxPolicy -Name “SurfaceHubs” -PasswordEnabled $false
|
||||
```
|
||||
```PowerShell
|
||||
$easPolicy = New-MobileDeviceMailboxPolicy -Name “SurfaceHubs” -PasswordEnabled $false
|
||||
```
|
||||
|
||||
Once you have a compatible policy, then you will need to apply the policy to the device account. However, policies can only be applied to user accounts and not resource mailboxes. You need to convert the mailbox into a user type, apply the policy, and then convert it back into a mailbox—you may need to re-enable it and set the password again too.
|
||||
Once you have a compatible policy, you will need to apply the policy to the device account. However, policies can only be applied to user accounts and not resource mailboxes. You need to convert the mailbox into a user type, apply the policy, and then convert it back into a mailbox—you may need to re-enable it and set the password again too.
|
||||
|
||||
```PowerShell
|
||||
Set-Mailbox 'HUB01@contoso.com' -Type Regular
|
||||
Set-CASMailbox 'HUB01@contoso.com' -ActiveSyncMailboxPolicy $easPolicy.id
|
||||
Set-Mailbox 'HUB01@contoso.com' -Type Room
|
||||
$credNewAccount = Get-Credential -Message "Please provide the Surface Hub username and password"
|
||||
Set-Mailbox 'HUB01@contoso.com' -RoomMailboxPassword $credNewAccount.Password -EnableRoomMailboxAccount $true
|
||||
```
|
||||
```PowerShell
|
||||
Set-Mailbox 'HUB01@contoso.com' -Type Regular
|
||||
Set-CASMailbox 'HUB01@contoso.com' -ActiveSyncMailboxPolicy $easPolicy.id
|
||||
Set-Mailbox 'HUB01@contoso.com' -Type Room
|
||||
$credNewAccount = Get-Credential -Message "Please provide the Surface Hub username and password"
|
||||
Set-Mailbox 'HUB01@contoso.com' -RoomMailboxPassword $credNewAccount.Password -EnableRoomMailboxAccount $true
|
||||
```
|
||||
|
||||
4. Set Exchange properties.
|
||||
4. Set Exchange properties.
|
||||
|
||||
Various Exchange properties must be set on the device account to improve the meeting experience. You can see which properties need to be set in the [Exchange properties](exchange-properties-for-surface-hub-device-accounts.md) section.
|
||||
Various Exchange properties must be set on the device account to improve the meeting experience. You can see which properties need to be set in the [Exchange properties](exchange-properties-for-surface-hub-device-accounts.md) section.
|
||||
|
||||
```PowerShell
|
||||
Set-CalendarProcessing -Identity 'HUB01@contoso.com' -AutomateProcessing AutoAccept -AddOrganizerToSubject $false –AllowConflicts $false –DeleteComments $false -DeleteSubject $false -RemovePrivateProperty $false
|
||||
Set-CalendarProcessing -Identity 'HUB01@contoso.com' -AddAdditionalResponse $true -AdditionalResponse "This is a Surface Hub room!"
|
||||
```
|
||||
```PowerShell
|
||||
Set-CalendarProcessing -Identity 'HUB01@contoso.com' -AutomateProcessing AutoAccept -AddOrganizerToSubject $false –AllowConflicts $false –DeleteComments $false -DeleteSubject $false -RemovePrivateProperty $false
|
||||
Set-CalendarProcessing -Identity 'HUB01@contoso.com' -AddAdditionalResponse $true -AdditionalResponse "This is a Surface Hub room!"
|
||||
```
|
||||
|
||||
5. Add email address for your on-premises domain account.
|
||||
5. Add an email address for your on-premises domain account.
|
||||
|
||||
For this procedure, you'll be using AD admin tools to add an email address for your on-premises domain account.
|
||||
|
||||
- In **Active Directory Users and Computers** AD tool, right-click on the folder or Organizational Unit that your Surface Hub accounts will be created in, click **New**, and **User**.
|
||||
- Type the display name from the previous cmdlet into the **Full name** box, and the alias into the **User logon name** box. Click **Next**.
|
||||
For this procedure, you'll be using AD admin tools to add an email address for your on-premises domain account.
|
||||
|
||||
|
||||
- In **Active Directory Users and Computers** AD tool, right-click on the folder or Organizational Unit that your Surface Hub accounts will be created in, click **New**, and **User**.
|
||||
- Type the display name from the previous cmdlet into the **Full name** box, and the alias into the **User logon name** box. Click **Next**.
|
||||
|
||||
- Type the password for this account. You'll need to retype it for verification. Make sure the **Password never expires** checkbox is the only option selected.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>Selecting **Password never expires** is a requirement for Skype for Business on the Surface Hub. Your domain rules may prohibit passwords that don't expire. If so, you'll need to create an exception for each Surface Hub device account.
|
||||
|
||||
|
||||
|
||||
- Click **Finish** to create the account.
|
||||
|
||||
|
||||
|
||||
- Type the password for this account. You'll need to retype it for verification. Make sure the **Password never expires** checkbox is the only option selected.
|
||||
|
||||
6. Run directory synchronization.
|
||||
> [!IMPORTANT]
|
||||
> Selecting **Password never expires** is a requirement for Skype for Business on the Surface Hub. Your domain rules may prohibit passwords that don't expire. If so, you'll need to create an exception for each Surface Hub device account.
|
||||
|
||||
After you've created the account, run a directory synchronization. When it's complete, go to the users page and verify that the two accounts created in the previous steps have merged.
|
||||
|
||||
|
||||
7. Connect to Azure AD.
|
||||
- Click **Finish** to create the account.
|
||||
|
||||
You first need to install Azure AD module for PowerShell version 2. In an elevated powershell prompt run the following command :
|
||||
|
||||
```PowerShell
|
||||
Install-Module -Name AzureAD
|
||||
```
|
||||
You need to connect to Azure AD to apply some account settings. You can run this cmdlet to connect.
|
||||
|
||||
|
||||
```PowerShell
|
||||
Import-Module AzureAD
|
||||
Connect-AzureAD -Credential $cred
|
||||
```
|
||||
6. Run directory synchronization.
|
||||
|
||||
8. Assign an Office 365 license.
|
||||
After you've created the account, run a directory synchronization. When it's complete, go to the users page and verify that the two accounts created in the previous steps have merged.
|
||||
|
||||
The device account needs to have a valid Office 365 (O365) license, or Exchange and Skype for Business will not work. If you have the license, you need to assign a usage location to your device account—this determines what license SKUs are available for your account.
|
||||
7. Connect to Azure AD.
|
||||
|
||||
Next, you can use `Get-AzureADSubscribedSku` to retrieve a list of available SKUs for your O365 tenant.
|
||||
You first need to install Azure AD module for PowerShell version 2. In an elevated PowerShell prompt, run the following command:
|
||||
|
||||
Once you list out the SKUs, you'll need to assign the SkuId you want to the `$License.SkuId` variable.
|
||||
```PowerShell
|
||||
Install-Module -Name AzureAD
|
||||
```
|
||||
|
||||
```PowerShell
|
||||
Set-AzureADUser -ObjectId "HUB01@contoso.com" -UsageLocation "US"
|
||||
|
||||
Get-AzureADSubscribedSku | Select Sku*,*Units
|
||||
$License = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicense
|
||||
$License.SkuId = SkuId You selected
|
||||
|
||||
$AssignedLicenses = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicenses
|
||||
$AssignedLicenses.AddLicenses = $License
|
||||
$AssignedLicenses.RemoveLicenses = @()
|
||||
|
||||
Set-AzureADUserLicense -ObjectId "HUB01@contoso.com" -AssignedLicenses $AssignedLicenses
|
||||
```
|
||||
You need to connect to Azure AD to apply some account settings. You can run this cmdlet to connect:
|
||||
|
||||
Next, you enable the device account with [Skype for Business Online](#sfb-online), [Skype for Business on-premises](#sfb-onprem), or [Skype for Business hybrid](#sfb-hybrid).
|
||||
```PowerShell
|
||||
Import-Module AzureAD
|
||||
Connect-AzureAD -Credential $cred
|
||||
```
|
||||
|
||||
8. Assign an Office 365 license.
|
||||
|
||||
### Skype for Business Online
|
||||
|
||||
In order to enable Skype for Business, your environment will need to meet the [prerequisites for Skype for Business online](#sfb-online).
|
||||
The device account needs to have a valid Office 365 (O365) license, or Exchange and Skype for Business will not work. If you have the license, you need to assign a usage location to your device account—this determines what license SKUs are available for your account.
|
||||
|
||||
Next, you can use `Get-AzureADSubscribedSku` to retrieve a list of available SKUs for your O365 tenant.
|
||||
|
||||
Once you list out the SKUs, you'll need to assign the SkuId you want to the `$License.SkuId` variable.
|
||||
|
||||
```PowerShell
|
||||
Set-AzureADUser -ObjectId "HUB01@contoso.com" -UsageLocation "US"
|
||||
|
||||
Get-AzureADSubscribedSku | Select Sku*,*Units
|
||||
$License = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicense
|
||||
$License.SkuId = SkuId You selected
|
||||
|
||||
$AssignedLicenses = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicenses
|
||||
$AssignedLicenses.AddLicenses = $License
|
||||
$AssignedLicenses.RemoveLicenses = @()
|
||||
|
||||
Set-AzureADUserLicense -ObjectId "HUB01@contoso.com" -AssignedLicenses $AssignedLicenses
|
||||
```
|
||||
|
||||
Next, you enable the device account with [Skype for Business Online](#skype-for-business-online), [Skype for Business on-premises](#skype-for-business-on-premises), or [Skype for Business hybrid](#skype-for-business-hybrid).
|
||||
|
||||
### Skype for Business Online
|
||||
|
||||
In order to enable Skype for Business, your environment will need to meet the [prerequisites for Skype for Business online](#skype-for-business-online).
|
||||
|
||||
1. Start by creating a remote PowerShell session to the Skype for Business online environment from a PC.
|
||||
|
||||
```PowerShell
|
||||
Import-Module SkypeOnlineConnector
|
||||
$cssess=New-CsOnlineSession -Credential $cred
|
||||
Import-PSSession $cssess -AllowClobber
|
||||
```
|
||||
```PowerShell
|
||||
Import-Module SkypeOnlineConnector
|
||||
$cssess=New-CsOnlineSession -Credential $cred
|
||||
Import-PSSession $cssess -AllowClobber
|
||||
```
|
||||
|
||||
2. To enable your Surface Hub account for Skype for Business Server, run this cmdlet:
|
||||
|
||||
```PowerShell
|
||||
Enable-CsMeetingRoom -Identity 'HUB01@contoso.com' -RegistrarPool
|
||||
'sippoolbl20a04.infra.lync.com' -SipAddressType UserPrincipalName
|
||||
```
|
||||
```PowerShell
|
||||
Enable-CsMeetingRoom -Identity 'HUB01@contoso.com' -RegistrarPool
|
||||
'sippoolbl20a04.infra.lync.com' -SipAddressType UserPrincipalName
|
||||
```
|
||||
|
||||
If you aren't sure what value to use for the `RegistrarPool` parameter in your environment, you can get the value from an existing Skype for Business user using this cmdlet:
|
||||
|
||||
```PowerShell
|
||||
Get-CsOnlineUser -Identity 'HUB01@contoso.com'| fl *registrarpool*
|
||||
```
|
||||
```PowerShell
|
||||
Get-CsOnlineUser -Identity 'HUB01@contoso.com'| fl *registrarpool*
|
||||
```
|
||||
|
||||
10. Assign Skype for Business license to your Surface Hub account
|
||||
|
||||
Once you've completed the preceding steps to enable your Surface Hub account in Skype for Business Online, you need to assign a license to the Surface Hub. Using the O365 administrative portal, assign either a Skype for Business Online (Plan 2) or a Skype for Business Online (Plan 3) to the device.
|
||||
Once you've completed the preceding steps to enable your Surface Hub account in Skype for Business Online, you need to assign a license to the Surface Hub. Using the O365 administrative portal, assign either a Skype for Business Online (Plan 2) or a Skype for Business Online (Plan 3) license to the device.
|
||||
|
||||
- Sign in as a tenant administrator, open the O365 Administrative Portal, and click on the Admin app.
|
||||
|
||||
- Click on **Users and Groups** and then **Add users, reset passwords, and more**.
|
||||
|
||||
- Click the Surface Hub account, and then click the pen icon to edit the account information.
|
||||
|
||||
- Click **Licenses**.
|
||||
|
||||
- In **Assign licenses**, select Skype for Business (Plan 2) or Skype for Business (Plan 3), depending on your licensing and Enterprise Voice requirements. You'll have to use a Plan 3 license if you want to use Enterprise Voice on your Surface Hub.
|
||||
|
||||
- Click **Save**.
|
||||
- Sign in as a tenant administrator, open the O365 Administrative Portal, and click on the Admin app.
|
||||
|
||||
>[!NOTE]
|
||||
> You can also use the Windows Azure Active Directory Module for Windows PowerShell to run the cmdlets needed to assign one of these licenses, but that's not covered here.
|
||||
- Click on **Users and Groups** and then **Add users, reset passwords, and more**.
|
||||
|
||||
- Click the Surface Hub account, and then click the pen icon to edit the account information.
|
||||
|
||||
- Click **Licenses**.
|
||||
|
||||
- In **Assign licenses**, select Skype for Business (Plan 2) or Skype for Business (Plan 3), depending on your licensing and Enterprise Voice requirements. You'll have to use a Plan 3 license if you want to use Enterprise Voice on your Surface Hub.
|
||||
|
||||
- Click **Save**.
|
||||
|
||||
> [!NOTE]
|
||||
> You can also use the Windows Azure Active Directory Module for Windows PowerShell to run the cmdlets needed to assign one of these licenses, but that's not covered here.
|
||||
|
||||
For validation, you should be able to use any Skype for Business client (PC, Android, etc) to sign in to this account.
|
||||
|
||||
<span id="sfb-onprem"/>
|
||||
### Skype for Business on-premises
|
||||
|
||||
To run this cmdlet, you will need to connect to one of the Skype front-ends. Open the Skype PowerShell and run:
|
||||
@ -400,15 +401,13 @@ To run this cmdlet, you will need to connect to one of the Skype front-ends. Ope
|
||||
Enable-CsMeetingRoom -Identity 'HUB01@contoso.com' -RegistrarPool registrarpoolfqdn -SipAddressType UserPrincipalName
|
||||
```
|
||||
|
||||
<span id="sfb-hybrid"/>
|
||||
### Skype for Business hybrid
|
||||
|
||||
If your organization has set up [hybrid connectivity between Skype for Business Server and Skype for Business Online](https://technet.microsoft.com/library/jj205403.aspx), the guidance for creating accounts differs from a standard Surface Hub deployment.
|
||||
|
||||
The Surface Hub requires a Skype account of the type *meetingroom*, while a normal user would use a *user* type account in Skype. If your Skype server is set up for hybrid where you might have users on the local Skype server as well as users hosted in Office 365, you might run into a few issues when trying to create a Surface Hub account.
|
||||
|
||||
|
||||
In Skype for Business Server 2015 hybrid environment, any user that you want in Skype for Business Online must first be created in the on-premises deployment, so that the user account is created in Active Directory Domain Services. You can then move the user to Skype for Business Online. The move of a user account from on-premises to online is done via the [Move-CsUser](https://technet.microsoft.com/library/gg398528.aspx) cmdlet. To move a Csmeetingroom object, use the [Move-CsMeetingRoom](https://technet.microsoft.com/library/jj204889.aspx?f=255&mspperror=-2147217396) cmdlet.
|
||||
|
||||
>[!NOTE]
|
||||
>To use the Move-CsMeetingRoom cmdlet, you must have installed [the May 2017 cumulative update 6.0.9319.281 for Skype for Business Server 2015](https://support.microsoft.com/help/4020991/enables-the-move-csmeetingroom-cmdlet-to-move-a-meeting-room-from-on-p) or [the July 2017 cumulative update 5.0.8308.992 for Lync Server 2013](https://support.microsoft.com/help/4034279/enables-the-move-csmeetingroom-cmdlet-to-move-a-meeting-room-from-on-p).
|
||||
|
||||
> [!NOTE]
|
||||
> To use the Move-CsMeetingRoom cmdlet, you must have installed [the May 2017 cumulative update 6.0.9319.281 for Skype for Business Server 2015](https://support.microsoft.com/help/4020991/enables-the-move-csmeetingroom-cmdlet-to-move-a-meeting-room-from-on-p) or [the July 2017 cumulative update 5.0.8308.992 for Lync Server 2013](https://support.microsoft.com/help/4034279/enables-the-move-csmeetingroom-cmdlet-to-move-a-meeting-room-from-on-p).
|
||||
|
||||
@ -117,9 +117,9 @@ The following tables include info on Windows 10 settings that have been validate
|
||||
| Allow Do Not Track | Use to enable Do Not Track headers. | [Browser/AllowDoNotTrack](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowDoNotTrack) | Yes <br> [Use a custom policy.](#example-intune) | Yes.<br> [Use a custom setting.](#example-sccm) | Yes |
|
||||
| Allow pop-ups | Use to block pop-up browser windows. | [Browser/AllowPopups](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowPopups) | Yes <br> [Use a custom policy.](#example-intune) | Yes.<br> [Use a custom setting.](#example-sccm) | Yes |
|
||||
| Allow search suggestions | Use to block search suggestions in the address bar. | [Browser/AllowSearchSuggestionsinAddressBar](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowSearchSuggestionsinAddressBar) | Yes <br> [Use a custom policy.](#example-intune) | Yes.<br> [Use a custom setting.](#example-sccm) | Yes |
|
||||
| Allow SmartScreen | Keep this enabled to turn on SmartScreen. | [Browser/AllowSmartScreen](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowSmartScreen) | Yes <br> [Use a custom policy.](#example-intune) | Yes.<br> [Use a custom setting.](#example-sccm) | Yes |
|
||||
| Prevent ignoring SmartScreen Filter warnings for websites | For extra security, use to stop users from ignoring SmartScreen Filter warnings and block them from accessing potentially malicious websites. | [Browser/PreventSmartScreenPromptOverride](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_PreventSmartScreenPromptOverride) | Yes <br> [Use a custom policy.](#example-intune) | Yes.<br> [Use a custom setting.](#example-sccm) | Yes |
|
||||
| Prevent ignoring SmartScreen Filter warnings for files | For extra security, use to stop users from ignoring SmartScreen Filter warnings and block them from downloading unverified files from Microsoft Edge. | [Browser/PreventSmartScreenPromptOverrideForFiles](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_PreventSmartScreenPromptOverrideForFiles) | Yes <br> [Use a custom policy.](#example-intune) | Yes.<br> [Use a custom setting.](#example-sccm) | Yes |
|
||||
| Allow Windows Defender SmartScreen | Keep this enabled to turn on Windows Defender SmartScreen. | [Browser/AllowSmartScreen](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowSmartScreen) | Yes <br> [Use a custom policy.](#example-intune) | Yes.<br> [Use a custom setting.](#example-sccm) | Yes |
|
||||
| Prevent ignoring Windows Defender SmartScreen warnings for websites | For extra security, use to stop users from ignoring Windows Defender SmartScreen warnings and block them from accessing potentially malicious websites. | [Browser/PreventSmartScreenPromptOverride](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_PreventSmartScreenPromptOverride) | Yes <br> [Use a custom policy.](#example-intune) | Yes.<br> [Use a custom setting.](#example-sccm) | Yes |
|
||||
| Prevent ignoring Windows Defender SmartScreen warnings for files | For extra security, use to stop users from ignoring Windows Defender SmartScreen warnings and block them from downloading unverified files from Microsoft Edge. | [Browser/PreventSmartScreenPromptOverrideForFiles](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_PreventSmartScreenPromptOverrideForFiles) | Yes <br> [Use a custom policy.](#example-intune) | Yes.<br> [Use a custom setting.](#example-sccm) | Yes |
|
||||
|
||||
\*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package.
|
||||
|
||||
|
||||
@ -90,7 +90,7 @@ If you have a pure, online (O365) deployment, then you can [use the provided Pow
|
||||
Set-AzureADUser -ObjectId "HUB01@contoso.com" -PasswordPolicies "DisablePasswordExpiration"
|
||||
```
|
||||
|
||||
7. Surface Hub requires a license for Skype for Business functionality. In order to enable Skype for Business, your environment will need to meet the [prerequisites for Skype for Business online](hybrid-deployment-surface-hub-device-accounts.md#sfb-online).
|
||||
7. Surface Hub requires a license for Skype for Business functionality. In order to enable Skype for Business, your environment will need to meet the [prerequisites for Skype for Business online](hybrid-deployment-surface-hub-device-accounts.md#skype-for-business-online).
|
||||
|
||||
Next, you can use `Get-AzureADSubscribedSku` to retrieve a list of available SKUs for your O365 tenant.
|
||||
|
||||
@ -124,13 +124,13 @@ If you have a pure, online (O365) deployment, then you can [use the provided Pow
|
||||
- Next, if you aren't sure what value to use for the `RegistrarPool` parameter in your environment, you can get the value from an existing Skype for Business user using this cmdlet (for example, <em>alice@contoso.com</em>):
|
||||
|
||||
```PowerShell
|
||||
(Get-CsTenant).TenantPoolExtension
|
||||
Get-CsOnlineUser -Identity 'alice@contoso.com' | fl registrarpool
|
||||
```
|
||||
OR by setting a variable
|
||||
|
||||
```PowerShell
|
||||
$strRegistrarPool = (Get-CsTenant).TenantPoolExtension
|
||||
$strRegistrarPool = $strRegistrarPool[0].Substring($strRegistrarPool[0].IndexOf(':') + 1)
|
||||
$strRegistrarPool = Get-CsOnlineUser -Identity 'alice@contoso.com' | fl registrarpool | out-string
|
||||
$strRegistrarPool = $strRegistrarPool.Substring($strRegistrarPool.IndexOf(':') + 2)
|
||||
```
|
||||
|
||||
- Enable the Surface Hub account with the following cmdlet:
|
||||
|
||||
@ -54,25 +54,26 @@ Instead of using the Microsoft Admin Center portal, you can create the account u
|
||||
|
||||
### Connect to Exchange Online PowerShell
|
||||
|
||||
```
|
||||
$365Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell -Credential (Get-Credential) -Authentication Basic –AllowRedirection $ImportResults = Import-PSSession $365Session
|
||||
```powershell
|
||||
$365Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell -Credential (Get-Credential) -Authentication Basic –AllowRedirection
|
||||
$ImportResults = Import-PSSession $365Session
|
||||
```
|
||||
|
||||
### Create a new Room Mailbox
|
||||
|
||||
```
|
||||
```powershell
|
||||
New-Mailbox -MicrosoftOnlineServicesID account@YourDomain.com -Alias SurfaceHub2S -Name SurfaceHub2S -Room -EnableRoomMailboxAccount $true -RoomMailboxPassword (ConvertTo-SecureString -String "<Enter Strong Password>" -AsPlainText -Force)
|
||||
```
|
||||
|
||||
### Set Calendar Auto processing
|
||||
|
||||
```
|
||||
```powershell
|
||||
Set-CalendarProcessing -Identity "account@YourDomain.com" -AutomateProcessing AutoAccept -AddOrganizerToSubject $false –AllowConflicts $false –DeleteComments $false -DeleteSubject $false -RemovePrivateProperty $false -AddAdditionalResponse $true -AdditionalResponse "This room is equipped with a Surface Hub"
|
||||
```
|
||||
|
||||
### Assign a license
|
||||
|
||||
```
|
||||
```powershell
|
||||
Connect-MsolService
|
||||
Set-Msoluser -UserPrincipalName account@YourDomain.com -UsageLocation IE
|
||||
Set-MsolUserLicense -UserPrincipalName "account@YourDomain.com" -AddLicenses "contoso:MEETING_ROOM"
|
||||
@ -85,10 +86,11 @@ Set-MsolUserLicense -UserPrincipalName "account@YourDomain.com" -AddLicenses "co
|
||||
- [Visual C++ 2017 Redistributable](https://aka.ms/vs/15/release/vc_redist.x64.exe)
|
||||
- [Skype for Business Online PowerShell Module](https://www.microsoft.com/download/confirmation.aspx?id=39366)
|
||||
|
||||
```
|
||||
```powershell
|
||||
Import-Module LyncOnlineConnector
|
||||
$SfBSession = New-CsOnlineSession -Credential (Get-Credential)
|
||||
Import-PSSession $SfBSession -AllowClobber
|
||||
Enable the Skype for Business meeting room
|
||||
|
||||
# Enable the Skype for Business meeting room
|
||||
Enable-CsMeetingRoom -Identity account@YourDomain.com -RegistrarPool(Get-CsTenant).Registrarpool -SipAddressType EmailAddress
|
||||
```
|
||||
|
||||
@ -9,7 +9,7 @@ ms.author: greglin
|
||||
manager: laurawi
|
||||
audience: Admin
|
||||
ms.topic: article
|
||||
ms.date: 06/20/2019
|
||||
ms.date: 12/05/2019
|
||||
ms.localizationpriority: Medium
|
||||
---
|
||||
|
||||
@ -38,13 +38,15 @@ New in Surface Hub 2S, you can now reinstall the device using a recovery image.
|
||||
Surface Hub 2S lets you reinstall the device using a recovery image, which allows you to reinstall the device to factory settings if you lost the Bitlocker key or no longer have admin credentials to the Settings app.
|
||||
|
||||
1. Begin with a USB 3.0 drive with 8 GB or 16 GB of storage, formatted as FAT32.
|
||||
2. Download recovery image from the [Surface Recovery website](https://support.microsoft.com/en-us/surfacerecoveryimage?devicetype=surfacehub2s) onto the USB drive and connect it to any USB-C or USB A port on Surface Hub 2S.
|
||||
3. Turn off the device. While holding down the Volume down button, press the Power button. Keep holding both buttons until you see the Windows logo. Release the Power button but continue to hold the Volume until the Install UI begins.
|
||||
2. From a separate PC, download the .zip file recovery image from the [Surface Recovery website](https://support.microsoft.com/surfacerecoveryimage?devicetype=surfacehub2s) and then return to these instructions.
|
||||
3. Unzip the downloaded file onto the root of the USB drive.
|
||||
4. Connect the USB drive to any USB-C or USB-A port on Surface Hub 2S.
|
||||
5. Turn off the device. While holding down the Volume down button, press the Power button. Keep holding both buttons until you see the Windows logo. Release the Power button but continue to hold the Volume until the Install UI begins.
|
||||
|
||||
 <br>
|
||||
|
||||
4. In the language selection screen, select the display language for your Surface Hub 2S.
|
||||
5. Choose **Recover from a drive** and **Fully clean the drive** and then select **Recover**. If prompted for a BitLocker key, select **Skip this drive**. Surface Hub 2S reboots several times and takes approximately 30 minutes to complete the recovery process.
|
||||
6. In the language selection screen, select the display language for your Surface Hub 2S.
|
||||
7. Choose **Recover from a drive** and **Fully clean the drive** and then select **Recover**. If prompted for a BitLocker key, select **Skip this drive**. Surface Hub 2S reboots several times and takes approximately 30 minutes to complete the recovery process.
|
||||
Remove the USB drive when the first time setup screen appears.
|
||||
|
||||
## Recover a locked Surface Hub
|
||||
|
||||
@ -19,7 +19,7 @@ ms.topic: article
|
||||
|
||||
# Deploy the latest firmware and drivers for Surface devices
|
||||
|
||||
> **Home users:** This article is only intended for technical support agents and IT professionals. If you're looking for help to install Surface updates or firmware on a home device, please see [Update Surface firmware and Windows 10](https://support.microsoft.com/help/4023505).
|
||||
> **Home users:** This article is only intended for technical support agents and IT professionals, and applies only to Surface devices. If you're looking for help to install Surface updates or firmware on a home device, please see [Update Surface firmware and Windows 10](https://support.microsoft.com/help/4023505).
|
||||
|
||||
Under typical conditions, Windows Update automatically keeps Windows Surface devices up-to-date by downloading and installing the latest device drivers and firmware. However, you may sometimes have to download and install updates manually. For example, you may have to manually manage updates when you deploy a new version of Windows.
|
||||
|
||||
|
||||
@ -19,6 +19,9 @@ ms.audience: itpro
|
||||
|
||||
# Top support solutions for Surface devices
|
||||
|
||||
> [!Note]
|
||||
> **Home users**: This article is only intended for use by IT professionals and technical support agents. If you're looking for help with a problem with your home device, please see [Surface Devices Help](https://support.microsoft.com/products/surface-devices).
|
||||
|
||||
Microsoft regularly releases both updates and solutions for Surface devices. To ensure your devices can receive future updates, including security updates, it's important to keep your Surface devices updated. For a complete listing of the update history, see [Surface update history](https://www.microsoft.com/surface/support/install-update-activate/surface-update-history) and [Install Surface and Windows updates](https://www.microsoft.com/surface/support/performance-and-maintenance/install-software-updates-for-surface?os=windows-10&=undefined).
|
||||
|
||||
|
||||
|
||||
@ -45,7 +45,10 @@ If preferred, you can manually complete the update as follows:
|
||||
|
||||
You can use Windows Installer commands (Msiexec.exe) to deploy Surface Dock Firmware Update to multiple devices across your network. When using System Center Configuration Manager or other deployment tool, enter the following syntax to ensure the installation is silent:
|
||||
|
||||
- **Msiexec.exe /i <name of msi> /quiet /norestart**
|
||||
- **Msiexec.exe /i <name of msi> /quiet /norestart**
|
||||
|
||||
> [!NOTE]
|
||||
> A log file is not created by default. In order to create a log file, you will need to append "/l*v [path]"
|
||||
|
||||
> [!NOTE]
|
||||
> A log file is not created by default. In order to create a log file, you will need to append "/l*v [path]"
|
||||
@ -89,11 +92,11 @@ Successful completion of Surface Dock Firmware Update results in new registry ke
|
||||
**Table 1. Log files for Surface Dock Firmware Update**
|
||||
|
||||
| Log | Location | Notes |
|
||||
| -------------------------------- | -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| Surface Dock Firmware Update log | /l*v %windir%\logs\ SurfaceDockFWI.log | |
|
||||
| Windows Device Install log | %windir%\inf\setupapi.dev.log | For more information about using Device Install Log, refer to [SetupAPI Logging](https://docs.microsoft.com/windows-hardware/drivers/install/setupapi-logging--windows-vista-and-later-). |
|
||||
| -------------------------------- | --------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| Surface Dock Firmware Update log | Path needs to be specified (see note) | Earlier versions of this tool wrote events to Applications and Services Logs\Microsoft Surface Dock Updater. |
|
||||
| Windows Device Install log | %windir%\inf\setupapi.dev.log | For more information about using Device Install Log, refer to [SetupAPI Logging](https://docs.microsoft.com/windows-hardware/drivers/install/setupapi-logging--windows-vista-and-later-) documentation. |
|
||||
|
||||
|
||||
|
||||
**Table 2. Event log IDs for Surface Dock Firmware Update**<br>
|
||||
Events are logged in the Application Event Log. Note: Earlier versions of this tool wrote events to Applications and Services Logs\Microsoft Surface Dock Updater.
|
||||
|
||||
|
||||
@ -24,6 +24,9 @@ System Model and System SKU are variables that are stored in the System Manageme
|
||||
|
||||
| Device | System Model | System SKU |
|
||||
| ---------- | ----------- | -------------- |
|
||||
| AMD Surface Laptop 3 | Surface 3 | Surface_Laptop_3_1873 |
|
||||
| Surface Laptop 3 | Surface 3 | Surface_Laptop_3_1867:1868 |
|
||||
| Surface Laptop 3 | Surface 3 | Surface_3
|
||||
| Surface 3 WiFI | Surface 3 | Surface_3 |
|
||||
| Surface 3 LTE AT&T | Surface 3 | Surface_3_US1 |
|
||||
| Surface 3 LTE Verizon | Surface 3 | Surface_3_US2 |
|
||||
|
||||
@ -1617,7 +1617,7 @@ As a final quality control step, verify the device configuration to ensure that
|
||||
* The device can connect to the Internet and view the appropriate web content in Microsoft Edge.
|
||||
* Windows Update is active and current with software updates.
|
||||
* Windows Defender is active and current with malware Security intelligence.
|
||||
* The SmartScreen Filter is active.
|
||||
* Windows Defender SmartScreen is active.
|
||||
* All Microsoft Store apps are properly installed and updated.
|
||||
* All Windows desktop apps are properly installed and updated.
|
||||
* Printers are properly configured.
|
||||
|
||||
@ -1096,7 +1096,7 @@ As a final quality control step, verify the device configuration to ensure that
|
||||
- The device can connect to the Internet and view the appropriate web content in Microsoft Edge.
|
||||
- Windows Update is active and current with software updates.
|
||||
- Windows Defender is active and current with malware Security intelligence.
|
||||
- The SmartScreen Filter is active.
|
||||
- Windows Defender SmartScreen is active.
|
||||
- All Microsoft Store apps are properly installed and updated.
|
||||
- All Windows desktop apps are properly installed and updated.
|
||||
- Printers are properly configured.
|
||||
|
||||
@ -19,7 +19,7 @@ Microsoft Advanced Group Policy Management (AGPM) extends the capabilities of th
|
||||
## AGPM Version Information
|
||||
|
||||
|
||||
[AGPM 4.0 SP3](agpm-40-sp3-navengl.md) supports Windows 10, Windows Server 2012 R2, Windows 8.1, Windows Server 2012, Windows Server 2008 R2, Windows 7, Windows Server 2008, and Windows Vista with SP1.
|
||||
[AGPM 4.0 SP3](agpm-40-sp3-navengl.md) supports Windows 10, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows 8.1, Windows Server 2012, Windows Server 2008 R2, Windows 7, Windows Server 2008, and Windows Vista with SP1.
|
||||
|
||||
[AGPM 4.0 SP2](agpm-40-sp2-navengl.md) supports Windows Server 2012 R2, Windows 8.1, Windows Server 2012, Windows Server 2008 R2, Windows 7, Windows Server 2008, and Windows Vista with SP1.
|
||||
|
||||
|
||||
@ -1,3 +1,4 @@
|
||||
---
|
||||
ms.reviewer:
|
||||
title: How to Revert Extension Points From an App-V 5.0 Package to an App-V 4.6 Package for a Specific User
|
||||
description: How to Revert Extension Points From an App-V 5.0 Package to an App-V 4.6 Package for a Specific User
|
||||
|
||||
@ -1,3 +1,4 @@
|
||||
---
|
||||
ms.reviewer:
|
||||
title: How to Use an App-V 4.6 Application From an App-V 5.0 Application
|
||||
description: How to Use an App-V 4.6 Application From an App-V 5.0 Application
|
||||
|
||||
@ -46,15 +46,22 @@ Ensure [Remote Credential Guard](/windows/access-protection/remote-credential-gu
|
||||
>
|
||||
>`net localgroup "Remote Desktop Users" /add "AzureAD\the-UPN-attribute-of-your-user"`, where *FirstnameLastname* is the name of the user profile in C:\Users\, which is created based on DisplayName attribute in Azure AD.
|
||||
>
|
||||
> This command only works for AADJ device users already added to any of the local groups (administrators).
|
||||
> Otherwise this command throws the below error. For example: </br>
|
||||
> for cloud only user: "There is no such global user or group : *name*" </br>
|
||||
> for synced user: "There is no such global user or group : *name*" </br>
|
||||
>
|
||||
>In Windows 10, version 1709, the user does not have to sign in to the remote device first.
|
||||
>
|
||||
>In Windows 10, version 1709, you can add other Azure AD users to the **Administrators** group on a device in **Settings** and restrict remote credentials to **Administrators**. If there is a problem connecting remotely, make sure that both devices are joined to Azure AD and that TPM is functioning properly on both devices.
|
||||
|
||||
4. Enter **Authenticated Users**, then click **Check Names**. If the **Name Not Found** window opens, click **Locations** and select this PC.
|
||||
|
||||
>[!TIP]
|
||||
>When you connect to the remote PC, enter your account name in this format: `AzureAD UPN`. The local PC must either be domain-joined or Azure AD-joined. The local PC and remote PC must be in the same Azure AD tenant.
|
||||
> [!TIP]
|
||||
> When you connect to the remote PC, enter your account name in this format: `AzureAD UPN`. The local PC must either be domain-joined or Azure AD-joined. The local PC and remote PC must be in the same Azure AD tenant.
|
||||
|
||||
> [!Note]
|
||||
> If you cannot connect using Remote Desktop Connection 6.0, then you must turn off new features of RDP 6.0 and revert back to RDP 5.0 by changing a few changes in the RDP file. See the details in the [support article](https://support.microsoft.com/help/941641/remote-desktop-connection-6-0-prompts-you-for-credentials-before-you-e).
|
||||
|
||||
## Supported configurations
|
||||
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
description: A full-sized view of the boot sequence flowchart.
|
||||
title: Boot sequence flowchart
|
||||
description: A full-sized view of the boot sequence flowchart.
|
||||
ms.date: 11/16/2018
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
@ -10,8 +10,8 @@ ms.topic: article
|
||||
ms.prod: w10
|
||||
---
|
||||
|
||||
# Boot sequence flowchart
|
||||
|
||||
Return to: [Advanced troubleshooting for Windows boot problems](advanced-troubleshooting-boot-problems.md)<br>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -12,13 +12,13 @@ ms.author: dansimp
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Manage the Settings app with Group Policy
|
||||
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10, Windows Server 2016
|
||||
|
||||
|
||||
# Manage the Settings app with Group Policy
|
||||
|
||||
You can now manage the pages that are shown in the Settings app by using Group Policy. This lets you hide specific pages from users. Before Windows 10, version 1703, you could either show everything in the Settings app or hide it completely.
|
||||
To make use of the Settings App group polices on Windows server 2016, install fix [4457127](https://support.microsoft.com/help/4457127/windows-10-update-kb4457127) or a later cumulative update.
|
||||
|
||||
|
||||
@ -237,7 +237,6 @@
|
||||
#### [Security](policy-csp-security.md)
|
||||
#### [ServiceControlManager](policy-csp-servicecontrolmanager.md)
|
||||
#### [Settings](policy-csp-settings.md)
|
||||
#### [SmartScreen](policy-csp-smartscreen.md)
|
||||
#### [Speech](policy-csp-speech.md)
|
||||
#### [Start](policy-csp-start.md)
|
||||
#### [Storage](policy-csp-storage.md)
|
||||
@ -253,6 +252,7 @@
|
||||
#### [Wifi](policy-csp-wifi.md)
|
||||
#### [WindowsConnectionManager](policy-csp-windowsconnectionmanager.md)
|
||||
#### [WindowsDefenderSecurityCenter](policy-csp-windowsdefendersecuritycenter.md)
|
||||
#### [WindowsDefenderSmartScreen](policy-csp-smartscreen.md)
|
||||
#### [WindowsInkWorkspace](policy-csp-windowsinkworkspace.md)
|
||||
#### [WindowsLogon](policy-csp-windowslogon.md)
|
||||
#### [WindowsPowerShell](policy-csp-windowspowershell.md)
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: ApplicationControl CSP
|
||||
description: ApplicationControl CSP
|
||||
title: ApplicationControl CSP DDF
|
||||
description: This topic shows the OMA DM device description framework (DDF) for the **ApplicationControl** configuration service provider. DDF files are used only with OMA DM provisioning XML.
|
||||
ms.author: dansimp
|
||||
ms.topic: article
|
||||
ms.prod: w10
|
||||
|
||||
@ -40,7 +40,7 @@ This node is the policy binary itself, which is encoded as base64.
|
||||
|
||||
Scope is dynamic. Supported operations are Get, Add, Delete, and Replace.
|
||||
|
||||
Value type is b64. Supported value is any well-formed WDAC policy, i.e. the base64-encoded content output by the ConvertFrom-CIPolicy cmdlet.
|
||||
Value type is b64. Supported value is a binary file, converted from the policy XML file by the ConvertFrom-CIPolicy cmdlet.
|
||||
|
||||
Default value is empty.
|
||||
|
||||
@ -118,8 +118,7 @@ To use ApplicationControl CSP, you must:
|
||||
- Know a generated policy’s GUID, which can be found in the policy xml as `<PolicyTypeID>`.
|
||||
- Convert the policies to binary format using the ConvertFrom-CIPolicy cmdlet in order to be deployed. The binary policy may be signed or unsigned.
|
||||
|
||||
If you are using hybrid MDM management with System Center Configuration Manager or using Intune, ensure that you are using Base64 as the Data type when using Custom OMA-URI
|
||||
functionality to apply the Code Integrity policy.
|
||||
If you are using hybrid MDM management with System Center Configuration Manager or using Intune, ensure that you are using Base64 as the Data type when using Custom OMA-URI functionality to apply the Code Integrity policy via uploading the binary file.
|
||||
|
||||
### Deploy policies
|
||||
To deploy a new base policy using the CSP, perform an ADD on **./Vendor/MSFT/ApplicationControl/Policies/_Policy GUID_/Policy** using the Base64-encoded policy node as {Data}. Refer to the the Format section in the Example 1 below.
|
||||
@ -224,4 +223,4 @@ The following is an example of Delete command:
|
||||
</Target>
|
||||
</Item>
|
||||
</Delete>
|
||||
```
|
||||
```
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: EnrollmentStatusTracking CSP
|
||||
description: EnrollmentStatusTracking CSP
|
||||
title: EnrollmentStatusTracking DDF
|
||||
description: This topic shows the OMA DM device description framework (DDF) for the EnrollmentStatusTracking configuration service provider. DDF files are used only with OMA DM provisioning XML.
|
||||
ms.author: dansimp
|
||||
ms.topic: article
|
||||
ms.prod: w10
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: EnrollmentStatusTracking CSP
|
||||
description: EnrollmentStatusTracking CSP
|
||||
description: During Autopilot deployment, you can configure the Enrollment Status Page (ESP) to block the device use until the required apps are installed.
|
||||
ms.author: dansimp
|
||||
ms.topic: article
|
||||
ms.prod: w10
|
||||
@ -11,7 +11,6 @@ ms.date: 05/21/2019
|
||||
|
||||
# EnrollmentStatusTracking CSP
|
||||
|
||||
|
||||
During Autopilot deployment, you can configure the Enrollment Status Page (ESP) to block the device use until the required apps are installed. You can select the apps that must be installed before using the device. The EnrollmentStatusTracking configuration service provider (CSP) is used by Intune's agents, such as SideCar to configure ESP for blocking the device use until the required Win32 apps are installed. It tracks the installation status of the required policy providers and the apps they install and sends it to ESP, which displays the installation progress message to the user. For more information on ESP, see [Windows Autopilot Enrollment Status page](https://docs.microsoft.com/windows/deployment/windows-autopilot/enrollment-status).
|
||||
|
||||
ESP uses the EnrollmentStatusTracking CSP along with the DMClient CSP to track the installation of different apps. The EnrollmentStatusTracking CSP tracks Win32 apps installations and DMClient CSP tracks MSI and Universal Windows Platform apps installations. In DMClient CSP, the **FirstSyncStatus/ExpectedMSIAppPackages** and **FirstSyncStatus/ExpectedModernAppPackages** nodes list the apps to track their installation. See [DMClient CSP](dmclient-csp.md) for more information.
|
||||
|
||||
@ -504,7 +504,7 @@ Supported operation is Get.
|
||||
|
||||
|
||||
|
||||
<a href="" id="appinstallation-packagefamilyname-lasterrordescription"></a>**AppInstallation/*PackageFamilyName*/LastErrorDescription**
|
||||
<a href="" id="appinstallation-packagefamilyname-lasterrordescription"></a>**AppInstallation/*PackageFamilyName*/LastErrorDesc**
|
||||
Required. Description of last error relating to the app installation.
|
||||
|
||||
Supported operation is Get.
|
||||
|
||||
@ -34,7 +34,7 @@ With Windows 10, version 1809, Microsoft is also releasing a Microsoft MDM secur
|
||||
|
||||
The MDM security baseline includes policies that cover the following areas:
|
||||
|
||||
- Microsoft inbox security technology (not deprecated) such as Bitlocker, Smartscreen, and DeviceGuard (virtual-based security), ExploitGuard, Defender, and Firewall
|
||||
- Microsoft inbox security technology (not deprecated) such as Bitlocker, Windows Defender Smartscreen, and DeviceGuard (virtual-based security), ExploitGuard, Defender, and Firewall
|
||||
- Restricting remote access to devices
|
||||
- Setting credential requirements for passwords and PINs
|
||||
- Restricting use of legacy technology
|
||||
|
||||
@ -190,7 +190,7 @@ Default value is false. If you set this policy to true, Remote Windows Hello for
|
||||
|
||||
Supported operations are Add, Get, Delete, and Replace.
|
||||
|
||||
*Not supported on Windows Holographic and Windows Holographic for Business.*
|
||||
*Not supported on Windows Holographic and Windows Holographic for Business prior to Windows 10 version 1903 (May 2019 Update).*
|
||||
|
||||
<a href="" id="tenantid-policies-usehellocertificatesassmartcardcertificates"></a>***TenantId*/Policies/UseHelloCertificatesAsSmartCardCertificates** (only for ./Device/Vendor/MSFT)
|
||||
Added in Windows 10, version 1809. If you enable this policy setting, applications use Windows Hello for Business certificates as smart card certificates. Biometric factors are unavailable when a user is asked to authorize the use of the certificate's private key. This policy setting is designed to allow compatibility with applications that rely exclusively on smart card certificates.
|
||||
@ -206,7 +206,7 @@ This node is deprecated. Use **Biometrics/UseBiometrics** node instead.
|
||||
|
||||
<a href="" id="biometrics--only-for---device-vendor-msft-"></a>**Biometrics** (only for ./Device/Vendor/MSFT)
|
||||
Node for defining biometric settings. This node was added in Windows 10, version 1511.
|
||||
*Not supported on Windows Holographic and Windows Holographic for Business.*
|
||||
*Not supported on Windows Holographic and Windows Holographic for Business prior to Windows 10 version 1903 (May 2019 Update).*
|
||||
|
||||
<a href="" id="biometrics-usebiometrics--only-for---device-vendor-msft-"></a>**Biometrics/UseBiometrics** (only for ./Device/Vendor/MSFT)
|
||||
Boolean value used to enable or disable the use of biometric gestures, such as face and fingerprint, as an alternative to the PIN gesture for Windows Hello for Business. Users must still configure a PIN if they configure biometric gestures to use in case of failures. This node was added in Windows 10, version 1511.
|
||||
@ -230,7 +230,7 @@ Note that enhanced anti-spoofing for Windows Hello face authentication is not re
|
||||
|
||||
Supported operations are Add, Get, Delete, and Replace.
|
||||
|
||||
*Not supported on Windows Holographic and Windows Holographic for Business.*
|
||||
*Not supported on Windows Holographic and Windows Holographic for Business prior to Windows 10 version 1903 (May 2019 Update).*
|
||||
|
||||
<a href="" id="deviceunlock"></a>**DeviceUnlock** (only for ./Device/Vendor/MSFT)
|
||||
Added in Windows 10, version 1803. Interior node.
|
||||
|
||||
@ -3202,7 +3202,7 @@ The following diagram shows the Policy configuration service provider in tree fo
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
### SmartScreen policies
|
||||
### Windows Defender SmartScreen policies
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
|
||||
@ -1748,7 +1748,7 @@ Most restricted value: 1
|
||||
To verify AllowSmartScreen is set to 0 (not allowed):
|
||||
|
||||
1. Click or tap **More** (…) and select **Settings** > **View Advanced settings**.
|
||||
2. Verify the setting **Help protect me from malicious sites and download with SmartScreen Filter** is disabled.
|
||||
2. Verify that the setting **Help protect me from malicious sites and download with Windows Defender SmartScreen** is disabled.
|
||||
|
||||
<!--/Validation-->
|
||||
<!--/Policy-->
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Policy CSP - TimeLanguageSettings
|
||||
title: Policy CSP - DeviceHealthMonitoring
|
||||
description: Policy CSP - TimeLanguageSettings
|
||||
ms.author: dansimp
|
||||
ms.topic: article
|
||||
|
||||
@ -2448,7 +2448,7 @@ ADMX Info:
|
||||
|
||||
Value and index pairs in the SyncML example:
|
||||
- http://adfs.contoso.org 1
|
||||
- http://microsoft.com 2
|
||||
- https://microsoft.com 2
|
||||
|
||||
<!--/Example-->
|
||||
<!--/Policy-->
|
||||
@ -3253,11 +3253,11 @@ ADMX Info:
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This policy setting determines whether the user can bypass warnings from SmartScreen Filter. SmartScreen Filter prevents the user from browsing to or downloading from sites that are known to host malicious content. SmartScreen Filter also prevents the execution of files that are known to be malicious.
|
||||
This policy setting determines whether the user can bypass warnings from Windows Defender SmartScreen. Windows Defender SmartScreen prevents the user from browsing to or downloading from sites that are known to host malicious content. Windows Defender SmartScreen also prevents the execution of files that are known to be malicious.
|
||||
|
||||
If you enable this policy setting, SmartScreen Filter warnings block the user.
|
||||
If you enable this policy setting, Windows Defender SmartScreen warnings block the user.
|
||||
|
||||
If you disable or do not configure this policy setting, the user can bypass SmartScreen Filter warnings.
|
||||
If you disable or do not configure this policy setting, the user can bypass Windows Defender SmartScreen warnings.
|
||||
|
||||
<!--/Description-->
|
||||
> [!TIP]
|
||||
@ -3324,11 +3324,11 @@ ADMX Info:
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This policy setting determines whether the user can bypass warnings from SmartScreen Filter. SmartScreen Filter warns the user about executable files that Internet Explorer users do not commonly download from the Internet.
|
||||
This policy setting determines whether the user can bypass warnings from Windows Defender SmartScreen. Windows Defender SmartScreen warns the user about executable files that Internet Explorer users do not commonly download from the Internet.
|
||||
|
||||
If you enable this policy setting, SmartScreen Filter warnings block the user.
|
||||
If you enable this policy setting, Windows Defender SmartScreen warnings block the user.
|
||||
|
||||
If you disable or do not configure this policy setting, the user can bypass SmartScreen Filter warnings.
|
||||
If you disable or do not configure this policy setting, the user can bypass Windows Defender SmartScreen warnings.
|
||||
|
||||
<!--/Description-->
|
||||
> [!TIP]
|
||||
@ -6501,13 +6501,13 @@ ADMX Info:
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.
|
||||
This policy setting controls whether Windows Defender SmartScreen scans pages in this zone for malicious content.
|
||||
|
||||
If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content.
|
||||
If you enable this policy setting, Windows Defender SmartScreen scans pages in this zone for malicious content.
|
||||
|
||||
If you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content.
|
||||
If you disable this policy setting, Windows Defender SmartScreen does not scan pages in this zone for malicious content.
|
||||
|
||||
If you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content.
|
||||
If you do not configure this policy setting, the user can choose whether Windows Defender SmartScreen scans pages in this zone for malicious content.
|
||||
|
||||
Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.
|
||||
|
||||
@ -8604,13 +8604,13 @@ ADMX Info:
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.
|
||||
This policy setting controls whether Windows Defender SmartScreen scans pages in this zone for malicious content.
|
||||
|
||||
If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content.
|
||||
If you enable this policy setting, Windows Defender SmartScreen scans pages in this zone for malicious content.
|
||||
|
||||
If you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content.
|
||||
If you disable this policy setting, Windows Defender SmartScreen does not scan pages in this zone for malicious content.
|
||||
|
||||
If you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content.
|
||||
If you do not configure this policy setting, the user can choose whether Windows Defender SmartScreen scans pages in this zone for malicious content.
|
||||
|
||||
Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.
|
||||
|
||||
@ -9561,13 +9561,13 @@ ADMX Info:
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.
|
||||
This policy setting controls whether Windows Defender SmartScreen scans pages in this zone for malicious content.
|
||||
|
||||
If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content.
|
||||
If you enable this policy setting, Windows Defender SmartScreen scans pages in this zone for malicious content.
|
||||
|
||||
If you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content.
|
||||
If you disable this policy setting, Windows Defender SmartScreen does not scan pages in this zone for malicious content.
|
||||
|
||||
If you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content.
|
||||
If you do not configure this policy setting, the user can choose whether Windows Defender SmartScreen scans pages in this zone for malicious content.
|
||||
|
||||
Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.
|
||||
|
||||
@ -10518,13 +10518,13 @@ ADMX Info:
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.
|
||||
This policy setting controls whether Windows Defender SmartScreen scans pages in this zone for malicious content.
|
||||
|
||||
If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content.
|
||||
If you enable this policy setting, Windows Defender SmartScreen scans pages in this zone for malicious content.
|
||||
|
||||
If you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content.
|
||||
If you disable this policy setting, Windows Defender SmartScreen does not scan pages in this zone for malicious content.
|
||||
|
||||
If you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content.
|
||||
If you do not configure this policy setting, the user can choose whether Windows Defender SmartScreen scans pages in this zone for malicious content.
|
||||
|
||||
Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.
|
||||
|
||||
@ -11481,13 +11481,13 @@ ADMX Info:
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.
|
||||
This policy setting controls whether Windows Defender SmartScreen scans pages in this zone for malicious content.
|
||||
|
||||
If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content.
|
||||
If you enable this policy setting, Windows Defender SmartScreen scans pages in this zone for malicious content.
|
||||
|
||||
If you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content.
|
||||
If you disable this policy setting, Windows Defender SmartScreen does not scan pages in this zone for malicious content.
|
||||
|
||||
If you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content.
|
||||
If you do not configure this policy setting, the user can choose whether Windows Defender SmartScreen scans pages in this zone for malicious content.
|
||||
|
||||
Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.
|
||||
|
||||
@ -12286,13 +12286,13 @@ ADMX Info:
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.
|
||||
This policy setting controls whether Windows Defender SmartScreen scans pages in this zone for malicious content.
|
||||
|
||||
If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content.
|
||||
If you enable this policy setting, Windows Defender SmartScreen scans pages in this zone for malicious content.
|
||||
|
||||
If you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content.
|
||||
If you disable this policy setting, Windows Defender SmartScreen does not scan pages in this zone for malicious content.
|
||||
|
||||
If you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content.
|
||||
If you do not configure this policy setting, the user can choose whether Windows Defender SmartScreen scans pages in this zone for malicious content.
|
||||
|
||||
Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.
|
||||
|
||||
@ -13170,13 +13170,13 @@ ADMX Info:
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.
|
||||
This policy setting controls whether Windows Defender SmartScreen scans pages in this zone for malicious content.
|
||||
|
||||
If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content.
|
||||
If you enable this policy setting, Windows Defender SmartScreen scans pages in this zone for malicious content.
|
||||
|
||||
If you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content.
|
||||
If you disable this policy setting, Windows Defender SmartScreen does not scan pages in this zone for malicious content.
|
||||
|
||||
If you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content.
|
||||
If you do not configure this policy setting, the user can choose whether Windows Defender SmartScreen scans pages in this zone for malicious content.
|
||||
|
||||
Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.
|
||||
|
||||
@ -14054,13 +14054,13 @@ ADMX Info:
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.
|
||||
This policy setting controls whether Windows Defender SmartScreen scans pages in this zone for malicious content.
|
||||
|
||||
If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content.
|
||||
If you enable this policy setting, Windows Defender SmartScreen scans pages in this zone for malicious content.
|
||||
|
||||
If you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content.
|
||||
If you disable this policy setting, Windows Defender SmartScreen does not scan pages in this zone for malicious content.
|
||||
|
||||
If you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content.
|
||||
If you do not configure this policy setting, the user can choose whether Windows Defender SmartScreen scans pages in this zone for malicious content.
|
||||
|
||||
Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.
|
||||
|
||||
@ -14733,11 +14733,11 @@ ADMX Info:
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This policy setting prevents the user from managing SmartScreen Filter, which warns the user if the website being visited is known for fraudulent attempts to gather personal information through "phishing," or is known to host malware.
|
||||
This policy setting prevents the user from managing Windows Defender SmartScreen, which warns the user if the website being visited is known for fraudulent attempts to gather personal information through "phishing," or is known to host malware.
|
||||
|
||||
If you enable this policy setting, the user is not prompted to turn on SmartScreen Filter. All website addresses that are not on the filter's allow list are sent automatically to Microsoft without prompting the user.
|
||||
If you enable this policy setting, the user is not prompted to turn on Windows Defender SmartScreen. All website addresses that are not on the filter's allow list are sent automatically to Microsoft without prompting the user.
|
||||
|
||||
If you disable or do not configure this policy setting, the user is prompted to decide whether to turn on SmartScreen Filter during the first-run experience.
|
||||
If you disable or do not configure this policy setting, the user is prompted to decide whether to turn on Windows Defender SmartScreen during the first-run experience.
|
||||
|
||||
<!--/Description-->
|
||||
> [!TIP]
|
||||
@ -16477,13 +16477,13 @@ ADMX Info:
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.
|
||||
This policy setting controls whether Windows Defender SmartScreen scans pages in this zone for malicious content.
|
||||
|
||||
If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content.
|
||||
If you enable this policy setting, Windows Defender SmartScreen scans pages in this zone for malicious content.
|
||||
|
||||
If you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content.
|
||||
If you disable this policy setting, Windows Defender SmartScreen does not scan pages in this zone for malicious content.
|
||||
|
||||
If you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content.
|
||||
If you do not configure this policy setting, the user can choose whether Windows Defender SmartScreen scans pages in this zone for malicious content.
|
||||
|
||||
Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.
|
||||
|
||||
@ -19053,13 +19053,13 @@ ADMX Info:
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.
|
||||
This policy setting controls whether Windows Defender SmartScreen scans pages in this zone for malicious content.
|
||||
|
||||
If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content.
|
||||
If you enable this policy setting, Windows Defender SmartScreen scans pages in this zone for malicious content.
|
||||
|
||||
If you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content.
|
||||
If you disable this policy setting, Windows Defender SmartScreen does not scan pages in this zone for malicious content.
|
||||
|
||||
If you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content.
|
||||
If you do not configure this policy setting, the user can choose whether Windows Defender SmartScreen scans pages in this zone for malicious content.
|
||||
|
||||
Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.
|
||||
|
||||
|
||||
@ -173,6 +173,9 @@ manager: dansimp
|
||||
|
||||
<hr/>
|
||||
|
||||
> [!NOTE]
|
||||
> To find data formats (and other policy-related details), see [Policy DDF file](https://docs.microsoft.com/windows/client-management/mdm/policy-ddf-file).
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="localpoliciessecurityoptions-accounts-blockmicrosoftaccounts"></a>**LocalPoliciesSecurityOptions/Accounts_BlockMicrosoftAccounts**
|
||||
|
||||
@ -3698,4 +3701,3 @@ Footnotes:
|
||||
- 6 - Added in Windows 10, version 1903.
|
||||
|
||||
<!--/Policies-->
|
||||
|
||||
|
||||
@ -130,3 +130,8 @@ Value type is Base64. Supported operation is Replace.
|
||||
Retrieves the binary result package of previous Settings2/Apply operation. This binary package contains XML describing the action taken for each individual setting.
|
||||
|
||||
Supported operation is Get.
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
[UEFI DDF file](./uefi-ddf.md)
|
||||
|
||||
@ -296,21 +296,13 @@ For links to these classes, see [**MDM Bridge WMI Provider**](https://msdn.micro
|
||||
[**Win32\_UninterruptiblePowerSupply**](https://msdn.microsoft.com/library/windows/hardware/aa394503) |
|
||||
[**Win32\_USBController**](https://msdn.microsoft.com/library/windows/hardware/aa394504) |
|
||||
[**Win32\_UTCTime**](https://msdn.microsoft.com/library/windows/hardware/aa394510) | 
|
||||
[**Win32\_VideoController**](https://msdn.microsoft.com/library/windows/hardware/aa394505) |
|
||||
[**Win32\_VideoController**](https://docs.microsoft.com/windows/win32/cimwin32prov/win32-videocontroller) |
|
||||
**Win32\_WindowsUpdateAgentVersion** |
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
|
||||
[Configuration service provider reference](configuration-service-provider-reference.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
10/10/2016
|
||||
|
||||
|
||||
|
||||
|
||||
## Related Links
|
||||
[CIM Video Controller](https://docs.microsoft.com/windows/win32/cimwin32prov/cim-videocontroller)
|
||||
|
||||
@ -634,12 +634,12 @@ The following settings for Microsoft Edge on Windows 10 Mobile can be managed.
|
||||
- **Allow InPrivate** Whether users can use InPrivate browsing
|
||||
- **Allow Password Manager** Whether users can use Password Manager to save and manage passwords locally
|
||||
- **Allow Search Suggestions in Address Bar** Whether search suggestions are shown in the address bar
|
||||
- **Allow SmartScreen** Whether SmartScreen Filter is enabled
|
||||
- **Allow Windows Defender SmartScreen** Whether Windows Defender SmartScreen is enabled
|
||||
- **Cookies** Whether cookies are allowed
|
||||
- **Favorites** Configure Favorite URLs
|
||||
- **First Run URL** The URL to open when a user launches Microsoft Edge for the first time
|
||||
- **Prevent SmartScreen Prompt Override** Whether users can override the SmartScreen warnings for URLs
|
||||
- **Prevent Smart Screen Prompt Override for Files** Whether users can override the SmartScreen warnings for files
|
||||
- **Prevent Windows Defender SmartScreen Prompt Override** Whether users can override the Windows Defender SmartScreen warnings for URLs
|
||||
- **Prevent Smart Screen Prompt Override for Files** Whether users can override the Windows Defender SmartScreen warnings for files
|
||||
|
||||
## Manage
|
||||
|
||||
|
||||
@ -18,23 +18,23 @@ Microsoft regularly releases both updates for Windows Server. To ensure your ser
|
||||
|
||||
This section contains advanced troubleshooting topics and links to help you resolve issues with Windows 10 in an enterprise or IT pro environment. Additional topics will be added as they become available.
|
||||
|
||||
### Troubleshoot 802.1x Authentication
|
||||
## Troubleshoot 802.1x Authentication
|
||||
- [Advanced Troubleshooting 802.1X Authentication](https://docs.microsoft.com/windows/client-management/advanced-troubleshooting-802-authentication)
|
||||
- [Data collection for troubleshooting 802.1X authentication](https://docs.microsoft.com/windows/client-management/data-collection-for-802-authentication)
|
||||
|
||||
### Troubleshoot BitLocker
|
||||
- [BitLocker overview and requirements FAQ (Windows 10)](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq)
|
||||
- [BitLocker Upgrading FAQ (Windows 10)](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-upgrading-faq)
|
||||
- [BitLocker frequently asked questions (FAQ) (Windows 10)](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-deployment-and-administration-faq)
|
||||
- [BitLocker Key Management FAQ (Windows 10)](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-key-management-faq)
|
||||
- [BitLocker To Go FAQ (Windows 10)](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-to-go-faq)
|
||||
- [BitLocker and Active Directory Domain Services (AD DS) FAQ (Windows 10)](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq)
|
||||
- [BitLocker Security FAQ (Windows 10)](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-security-faq)
|
||||
- [BitLocker frequently asked questions (FAQ) (Windows 10)](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-network-unlock-faq)
|
||||
- [Using BitLocker with other programs FAQ (Windows 10)](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-using-with-other-programs-faq)
|
||||
- [BitLocker recovery guide (Windows 10)](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan)
|
||||
## Troubleshoot BitLocker
|
||||
- [Guidelines for troubleshooting BitLocker](https://docs.microsoft.com/windows/security/information-protection/bitlocker/troubleshoot-bitlocker)
|
||||
- [BitLocker cannot encrypt a drive: known issues](https://docs.microsoft.com/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-issues)
|
||||
- [Enforcing BitLocker policies by using Intune: known issues](https://docs.microsoft.com/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues)
|
||||
- [BitLocker Network Unlock: known issues](https://docs.microsoft.com/windows/security/information-protection/bitlocker/ts-bitlocker-network-unlock-issues)
|
||||
- [BitLocker recovery: known issues](https://docs.microsoft.com/windows/security/information-protection/bitlocker/ts-bitlocker-recovery-issues)
|
||||
- [BitLocker configuration: known issues](https://docs.microsoft.com/windows/security/information-protection/bitlocker/ts-bitlocker-config-issues)
|
||||
- [BitLocker cannot encrypt a drive: known TPM issues](https://docs.microsoft.com/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues)
|
||||
- [BitLocker and TPM: other known issues](https://docs.microsoft.com/windows/security/information-protection/bitlocker/ts-bitlocker-tpm-issues)
|
||||
- [Decode Measured Boot logs to track PCR changes](https://docs.microsoft.com/windows/security/information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs)
|
||||
- [BitLocker frequently asked questions (FAQ)](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions)
|
||||
|
||||
### Troubleshoot Bugcheck and Stop errors
|
||||
## Troubleshoot Bugcheck and Stop errors
|
||||
- [Introduction to the page file](https://docs.microsoft.com/windows/client-management/introduction-page-file)
|
||||
- [How to determine the appropriate page file size for 64-bit versions of Windows](https://docs.microsoft.com/windows/client-management/determine-appropriate-page-file-size)
|
||||
- [Configure system failure and recovery options in Windows](https://docs.microsoft.com/windows/client-management/system-failure-recovery-options)
|
||||
@ -44,20 +44,20 @@ This section contains advanced troubleshooting topics and links to help you reso
|
||||
- [Blue Screen Data - Windows drivers](https://docs.microsoft.com/windows-hardware/drivers/debugger/blue-screen-data)
|
||||
- [Bug Check Code Reference - Windows drivers](https://docs.microsoft.com/windows-hardware/drivers/debugger/bug-check-code-reference2)
|
||||
|
||||
### Troubleshoot Credential Guard
|
||||
## Troubleshoot Credential Guard
|
||||
- [Windows Defender Credential Guard - Known issues (Windows 10)](https://docs.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard-known-issues)
|
||||
|
||||
### Troubleshoot Disks
|
||||
## Troubleshoot Disks
|
||||
- [MBR2GPT](https://docs.microsoft.com/windows/deployment/mbr-to-gpt)
|
||||
- [Windows and GPT FAQ](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-and-gpt-faq)
|
||||
|
||||
### Troubleshoot Kiosk mode
|
||||
## Troubleshoot Kiosk mode
|
||||
- [Troubleshoot kiosk mode issues](https://docs.microsoft.com/windows/configuration/kiosk-troubleshoot)
|
||||
|
||||
### Troubleshoot No Boot
|
||||
## Troubleshoot No Boot
|
||||
- [Advanced troubleshooting for Windows boot problems](https://docs.microsoft.com/windows/client-management/advanced-troubleshooting-boot-problems)
|
||||
|
||||
### Troubleshoot Push Button Reset
|
||||
## Troubleshoot Push Button Reset
|
||||
- [Push-button reset frequently-asked questions (FAQ)](https://docs.microsoft.com/windows-hardware/manufacture/desktop/pbr-faq)
|
||||
- [Push-button reset frequently-asked questions (FAQ)](https://docs.microsoft.com/windows-hardware/manufacture/desktop/pbr-validation)
|
||||
- [Recovery components](https://docs.microsoft.com/windows-hardware/manufacture/desktop/recovery-strategy-for-common-customizations)
|
||||
@ -66,46 +66,46 @@ This section contains advanced troubleshooting topics and links to help you reso
|
||||
- [Modern Standby FAQs](https://docs.microsoft.com/windows-hardware/design/device-experiences/modern-standby-faqs)
|
||||
|
||||
|
||||
### Troubleshoot Secure Boot
|
||||
## Troubleshoot Secure Boot
|
||||
- [Secure Boot isn't configured correctly: troubleshooting](https://docs.microsoft.com/windows-hardware/manufacture/desktop/secure-boot-isnt-configured-correctly-troubleshooting)
|
||||
|
||||
|
||||
### Troubleshoot Setup and Install
|
||||
## Troubleshoot Setup and Install
|
||||
- [Deployment Troubleshooting and Log Files](https://docs.microsoft.com/windows-hardware/manufacture/desktop/deployment-troubleshooting-and-log-files)
|
||||
|
||||
|
||||
### Troubleshoot Start Menu
|
||||
## Troubleshoot Start Menu
|
||||
- [Troubleshoot Start menu errors](https://docs.microsoft.com/windows/configuration/start-layout-troubleshoot)
|
||||
|
||||
|
||||
### Troubleshoot Subscription Activation
|
||||
## Troubleshoot Subscription Activation
|
||||
- [Deploy Windows 10 Enterprise licenses](https://docs.microsoft.com/windows/deployment/deploy-enterprise-licenses)
|
||||
|
||||
### Troubleshoot System Hang
|
||||
## Troubleshoot System Hang
|
||||
- [Advanced troubleshooting for Windows-based computer freeze issues](https://docs.microsoft.com/windows/client-management/troubleshoot-windows-freeze)
|
||||
|
||||
### Troubleshoot TCP/IP Communication
|
||||
## Troubleshoot TCP/IP Communication
|
||||
- [Collect data using Network Monitor](https://docs.microsoft.com/windows/client-management/troubleshoot-tcpip-netmon)
|
||||
- [Troubleshoot TCP/IP connectivity](https://docs.microsoft.com/windows/client-management/troubleshoot-tcpip-connectivity)
|
||||
- [Troubleshoot port exhaustion issues](https://docs.microsoft.com/windows/client-management/troubleshoot-tcpip-port-exhaust)
|
||||
- [Troubleshoot Remote Procedure Call (RPC) errors](https://docs.microsoft.com/windows/client-management/troubleshoot-tcpip-rpc-errors)
|
||||
|
||||
### Troubleshoot User State Migration Toolkit (USMT)
|
||||
## Troubleshoot User State Migration Toolkit (USMT)
|
||||
- [Common Issues](https://docs.microsoft.com/windows/deployment/usmt/usmt-common-issues)
|
||||
- [Frequently Asked Questions](https://docs.microsoft.com/windows/deployment/usmt/usmt-faq)
|
||||
- [Log Files](https://docs.microsoft.com/windows/deployment/usmt/usmt-log-files)
|
||||
- [Return Codes](https://docs.microsoft.com/windows/deployment/usmt/usmt-return-codes)
|
||||
|
||||
### Troubleshoot Windows Hello for Business (WHFB)
|
||||
## Troubleshoot Windows Hello for Business (WHFB)
|
||||
- [Windows Hello for Business Frequently Asked Questions](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-faq)
|
||||
- [Windows Hello errors during PIN creation (Windows 10)](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation)
|
||||
- [Event ID 300 - Windows Hello successfully created (Windows 10)](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-event-300)
|
||||
|
||||
|
||||
### Troubleshoot Windows Analytics
|
||||
## Troubleshoot Windows Analytics
|
||||
- [Frequently asked questions and troubleshooting Windows Analytics](https://docs.microsoft.com/windows/deployment/update/windows-analytics-faq-troubleshooting)
|
||||
|
||||
### Troubleshoot Windows Update
|
||||
## Troubleshoot Windows Update
|
||||
- [How Windows Update works](https://docs.microsoft.com/windows/deployment/update/how-windows-update-works)
|
||||
- [Windows Update log files](https://docs.microsoft.com/windows/deployment/update/windows-update-logs)
|
||||
- [Windows Update troubleshooting](https://docs.microsoft.com/windows/deployment/update/windows-update-troubleshooting)
|
||||
@ -114,7 +114,7 @@ This section contains advanced troubleshooting topics and links to help you reso
|
||||
- [Get started with Windows Update](https://docs.microsoft.com/windows/deployment/update/windows-update-overview)
|
||||
- [Servicing stack updates](https://docs.microsoft.com/windows/deployment/update/servicing-stack-updates)
|
||||
|
||||
### Troubleshoot Windows Upgrade
|
||||
## Troubleshoot Windows Upgrade
|
||||
- [Quick fixes - Windows IT Pro](https://docs.microsoft.com/windows/deployment/upgrade/quick-fixes)
|
||||
- [SetupDiag](https://docs.microsoft.com/windows/deployment/upgrade/setupdiag)
|
||||
- [Troubleshoot Windows 10 upgrade errors - Windows IT Pro](https://docs.microsoft.com/windows/deployment/upgrade/troubleshoot-upgrade-errors)
|
||||
@ -123,10 +123,10 @@ This section contains advanced troubleshooting topics and links to help you reso
|
||||
- [Log files - Windows IT Pro](https://docs.microsoft.com/windows/deployment/upgrade/log-files)
|
||||
- [Resolution procedures - Windows IT Pro](https://docs.microsoft.com/windows/deployment/upgrade/resolution-procedures)
|
||||
|
||||
### Troubleshoot Windows Recovery (WinRE)
|
||||
## Troubleshoot Windows Recovery (WinRE)
|
||||
- [Windows RE troubleshooting features](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-re-troubleshooting-features)
|
||||
|
||||
### Troubleshoot Wireless Connection
|
||||
## Troubleshoot Wireless Connection
|
||||
- [Advanced Troubleshooting Wireless Network Connectivity](https://docs.microsoft.com/windows/client-management/advanced-troubleshooting-wireless-network-connectivity)
|
||||
|
||||
## Other Resources
|
||||
|
||||
@ -135,8 +135,8 @@ This section describes the **Policies** settings that you can configure in [prov
|
||||
| [PreventCertErrorOverrides](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-preventcerterroroverrides) | Specify whether to override security warnings about sites that have SSL errors. | X | X | X | | X |
|
||||
| [PreventFirstRunPage](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider#browser-preventfirstrunpage) | Specify whether to enable or disable the First Run webpage. | X | | | | |
|
||||
| [PreventLiveTileDataCollection](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider#browser-preventlivetiledatacollection) | Specify whether Microsoft can collect information to create a Live Tile when pinning a site to Start from Microsoft Edge. | X | X | X | | X |
|
||||
| [PreventSmartScreenPromptOverride](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider#browser-preventsmartscreenpromptoverride) | Specify whether users can override the Windows Defender SmartScreen Filter warnings about potentially malicious websites. | X | X | X | | X |
|
||||
| [PreventSmartScreenPromptOverrideForFiles](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider#browser-preventsmartscreenpromptoverrideforfiles) | Specify whether users can override the Windows Defender SmartScreen Filter warnings about downloading unverified files. | X | X | X | | X |
|
||||
| [PreventSmartScreenPromptOverride](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider#browser-preventsmartscreenpromptoverride) | Specify whether users can override the Windows Defender SmartScreen warnings about potentially malicious websites. | X | X | X | | X |
|
||||
| [PreventSmartScreenPromptOverrideForFiles](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider#browser-preventsmartscreenpromptoverrideforfiles) | Specify whether users can override the Windows Defender SmartScreen warnings about downloading unverified files. | X | X | X | | X |
|
||||
PreventTabPreloading | Prevent Microsoft Edge from starting and loading the Start and New Tab page at Windows startup and each time Microsoft Edge is closed. Applies to Windows 10, version 1803 and earlier only. | X | | | | |
|
||||
| [PreventTurningOffRequiredExtensions](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider#browser-forceenabledextensions) | Enter a list of extensions in Microsoft Edge that users cannot turn off, using a semi-colon delimited list of extension package family names. | X | | | | |
|
||||
| [PreventUsingLocalHostIPAddressForWebRTC](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider#browser-preventusinglocalhostipaddressforwebrtc) | Specify whether a user's localhost IP address is displayed while making phone calls using the WebRTC protocol. | X | X | X | | X |
|
||||
|
||||
@ -28,7 +28,7 @@ The features described below are no longer being actively developed, and might b
|
||||
| Hyper-V vSwitch on LBFO | In a future release, the Hyper-V vSwitch will no longer have the capability to be bound to an LBFO team. Instead, it can be bound via [Switch Embedded Teaming](https://docs.microsoft.com/windows-server/virtualization/hyper-v-virtual-switch/rdma-and-switch-embedded-teaming#bkmk_sswitchembedded) (SET).| 1909 |
|
||||
| Language Community tab in Feedback Hub | The Language Community tab will be removed from the Feedback Hub. The standard feedback process: [Feedback Hub - Feedback](feedback-hub://?newFeedback=true&feedbackType=2) is the recommended way to provide translation feedback. | 1909 |
|
||||
| My People / People in the Shell | My People is no longer being developed. It may be removed in a future update. | 1909 |
|
||||
| TFS1/TFS2 IME | TSF1 and TSF2 IME will be replaced by TSF3 IME in a future release. [Text Services Framework](https://docs.microsoft.com/windows/win32/tsf/what-is-text-services-framework) (TFS) enables language technologies. TSF IME are Windows components that you can add to enable typing text for Japanese, Simplified Chinese, Traditional Chinese, and Korean languages. | 1909 |
|
||||
| TFS1/TFS2 IME | TSF1 and TSF2 IME will be replaced by TSF3 IME in a future release. [Text Services Framework](https://docs.microsoft.com/windows/win32/tsf/what-is-text-services-framework) (TSF) enables language technologies. TSF IME are Windows components that you can add to enable typing text for Japanese, Simplified Chinese, Traditional Chinese, and Korean languages. | 1909 |
|
||||
| Package State Roaming (PSR) | PSR will be removed in a future update. PSR allows non-Microsoft developers to access roaming data on devices, enabling developers of UWP applications to write data to Windows and synchronize it to other instantiations of Windows for that user. <br> <br>The recommended replacement for PSR is [Azure App Service](https://docs.microsoft.com/azure/app-service/). Azure App Service is widely supported, well documented, reliable, and supports cross-platform/cross-ecosystem scenarios such as iOS, Android and web. | 1909 |
|
||||
| XDDM-based remote display driver | Starting with this release, the Remote Desktop Services uses a Windows Display Driver Model (WDDM) based Indirect Display Driver (IDD) for a single session remote desktop. The support for Windows 2000 Display Driver Model (XDDM) based remote display drivers will be removed in a future release. Independent Software Vendors that use an XDDM-based remote display driver should plan a migration to the WDDM driver model. For more information about implementing a remote indirect display driver, ISVs can reach out to [rdsdev@microsoft.com](mailto:rdsdev@microsoft.com). | 1903 |
|
||||
| Taskbar settings roaming | Roaming of taskbar settings is no longer being developed and we plan to remove this capability in a future release. | 1903 |
|
||||
|
||||
@ -53,5 +53,5 @@ Typically, the improvements are reliability and performance improvements that do
|
||||
* Servicing stack updates contain the full servicing stack; as a result, typically administrators only need to install the latest servicing stack update for the operating system.
|
||||
* Installing servicing stack update does not require restarting the device, so installation should not be disruptive.
|
||||
* Servicing stack update releases are specific to the operating system version (build number), much like quality updates.
|
||||
* Search to install latest available [Servicing stack update for Windows 10](https://portal.msrc.microsoft.com/security-guidance/advisory/ADV990001).
|
||||
* Once a servicing stack update is installed, it cannot be removed or uninstalled from the machine.
|
||||
* Search to install latest available [Servicing stack update for Windows 10](https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV990001).
|
||||
* Once a servicing stack update is installed, it cannot be removed or uninstalled from the machine.
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Windows as a service
|
||||
title: Windows as a service news & resources
|
||||
ms.prod: w10
|
||||
ms.topic: article
|
||||
ms.manager: elizapo
|
||||
|
||||
@ -42,17 +42,17 @@ Two methods of peer-to-peer content distribution are available in Windows 10.
|
||||
| Delivery Optimization |  |  |  |  |
|
||||
| BranchCache |  |  | |  |
|
||||
|
||||
>[!NOTE]
|
||||
>System Center Configuration Manager has an additional feature called Client Peer Cache that allows peer-to-peer content sharing between clients you use System Center Configuration Manager to manage, in the same Configuration Manager boundary Group. For more information, see [Client Peer Cache](https://docs.microsoft.com/sccm/core/plan-design/hierarchy/client-peer-cache).
|
||||
> [!NOTE]
|
||||
> System Center Configuration Manager has an additional feature called Client Peer Cache that allows peer-to-peer content sharing between clients you use System Center Configuration Manager to manage, in the same Configuration Manager boundary Group. For more information, see [Client Peer Cache](https://docs.microsoft.com/sccm/core/plan-design/hierarchy/client-peer-cache).
|
||||
>
|
||||
>In addition to Client Peer Cache, similar functionality is available in the Windows Preinstallation Environment (Windows PE) for imaging-related content. Using this technology, clients imaging with System Center Configuration Manager task sequences can source operating system images, driver packages, boot images, packages, and programs from peers instead of distribution points. For detailed information about how Windows PE Peer Cache works and how to configure it, see [Prepare Windows PE peer cache to reduce WAN traffic in System Center Configuration Manager](https://technet.microsoft.com/library/mt613173.aspx).
|
||||
> In addition to Client Peer Cache, similar functionality is available in the Windows Preinstallation Environment (Windows PE) for imaging-related content. Using this technology, clients imaging with System Center Configuration Manager task sequences can source operating system images, driver packages, boot images, packages, and programs from peers instead of distribution points. For detailed information about how Windows PE Peer Cache works and how to configure it, see [Prepare Windows PE peer cache to reduce WAN traffic in System Center Configuration Manager](https://docs.microsoft.com/configmgr/osd/get-started/prepare-windows-pe-peer-cache-to-reduce-wan-traffic).
|
||||
|
||||
## Express update delivery
|
||||
|
||||
Windows 10 quality update downloads can be large because every package contains all previously released fixes to ensure consistency and simplicity. Windows has been able to reduce the size of Windows Update downloads with a feature called Express.
|
||||
|
||||
>[!NOTE]
|
||||
>Express update delivery applies to quality update downloads. Starting with Windows 10, version 1709, Express update delivery also applies to feature update downloads for clients connected to Windows Update and Windows Update for Business.
|
||||
> [!NOTE]
|
||||
> Express update delivery applies to quality update downloads. Starting with Windows 10, version 1709, Express update delivery also applies to feature update downloads for clients connected to Windows Update and Windows Update for Business.
|
||||
|
||||
### How Microsoft supports Express
|
||||
- **Express on System Center Configuration Manager** starting with version 1702 of Configuration Manager and Windows 10, version 1703 or later, or Windows 10, version 1607 with the April 2017 cumulative update.
|
||||
@ -81,8 +81,8 @@ The Windows Update client will try to download Express first, and under certain
|
||||
|
||||
At this point, the download is complete and the update is ready to be installed.
|
||||
|
||||
>[!TIP]
|
||||
>Express will **always** be leveraged if your machines are updated regularly with the latest cumulative updates.
|
||||
> [!TIP]
|
||||
> Express will **always** be leveraged if your machines are updated regularly with the latest cumulative updates.
|
||||
|
||||
## Steps to manage updates for Windows 10
|
||||
|
||||
@ -98,7 +98,6 @@ At this point, the download is complete and the update is ready to be installed.
|
||||
|
||||
## Related topics
|
||||
|
||||
|
||||
- [Update Windows 10 in the enterprise](index.md)
|
||||
- [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md)
|
||||
- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md)
|
||||
|
||||
@ -14,6 +14,7 @@ manager: laurawi
|
||||
ms.localizationpriority: high
|
||||
ms.collection: M365-modern-desktop
|
||||
---
|
||||
|
||||
# Windows as a service
|
||||
|
||||
Find the tools and resources you need to help deploy and support Windows as a service in your organization.
|
||||
|
||||
@ -6,7 +6,7 @@ ms.mktglfcycl:
|
||||
audience: itpro
|
||||
itproauthor: jaimeo
|
||||
author: jaimeo
|
||||
ms.localizationprioauthor: jaimeo
|
||||
ms.localizationpriority: medium
|
||||
ms.audience: itpro
|
||||
author: jaimeo
|
||||
ms.date: 09/18/2018
|
||||
|
||||
@ -21,7 +21,7 @@ ms.topic: article
|
||||
|
||||
With the release of Windows 10, we moved the update model to the Unified Update Platform. Unified Update Platform (UUP) is a single publishing, hosting, scan and download model for all types of OS updates, desktop and mobile for all Windows-based operating systems, for everything from monthly quality updates to new feature updates.
|
||||
|
||||
Ues the following information to get started with Windows Update:
|
||||
Use the following information to get started with Windows Update:
|
||||
|
||||
- Understand the UUP architecture
|
||||
- Understand [how Windows Update works](how-windows-update-works.md)
|
||||
|
||||
@ -1,28 +1,30 @@
|
||||
---
|
||||
title: Windows 10 deployment tools (Windows 10)
|
||||
description: Learn about the tools available to deploy Windows 10.
|
||||
ms.assetid: 5C4B0AE3-B2D0-4628-9E73-606F3FAA17BB
|
||||
ms.reviewer:
|
||||
manager: laurawi
|
||||
ms.audience: itpro
author: greg-lindsay
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
audience: itpro
author: greg-lindsay
|
||||
ms.date: 07/12/2017
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Windows 10 deployment tools
|
||||
|
||||
Learn about the tools available to deploy Windows 10.
|
||||
|
||||
|Topic |Description |
|
||||
|------|------------|
|
||||
|[Windows 10 deployment scenarios and tools](windows-deployment-scenarios-and-tools.md) |To successfully deploy the Windows 10 operating system and applications for your organization, it is essential that you know about the available tools to help with the process. In this topic, you will learn about the most commonly used tools for Windows 10 deployment. |
|
||||
|[Convert MBR partition to GPT](mbr-to-gpt.md) |This topic provides detailed instructions for using the MBR2GPT partition conversion tool. |
|
||||
|[Configure a PXE server to load Windows PE](configure-a-pxe-server-to-load-windows-pe.md) |This guide describes how to configure a PXE server to load Windows PE by booting a client computer from the network. |
|
||||
|[Windows ADK for Windows 10 scenarios for IT Pros](windows-adk-scenarios-for-it-pros.md) |The Windows Assessment and Deployment Kit (Windows ADK) contains tools that can be used by IT Pros to deploy Windows. |
|
||||
|[Deploy Windows To Go in your organization](deploy-windows-to-go.md) |This topic helps you to deploy Windows To Go in your organization. Before you begin deployment, make sure that you have reviewed the topics [Windows To Go: feature overview](planning/windows-to-go-overview.md) and [Prepare your organization for Windows To Go](planning/prepare-your-organization-for-windows-to-go.md) to ensure that you have the correct hardware and are prepared to complete the deployment. You can then use the steps in this topic to start your Windows To Go deployment. |
|
||||
|[Volume Activation Management Tool (VAMT) Technical Reference](volume-activation/volume-activation-management-tool.md) |The Volume Activation Management Tool (VAMT) enables network administrators and other IT professionals to automate and centrally manage the Windows®, Microsoft® Office, and select other Microsoft products volume and retail-activation process. |
|
||||
|[User State Migration Tool (USMT) Technical Reference](usmt/usmt-technical-reference.md) |The User State Migration Tool (USMT) 10.0 is included with the Windows Assessment and Deployment Kit (Windows ADK) for Windows 10. USMT provides a highly customizable user-profile migration experience for IT professionals |
|
||||
---
|
||||
title: Windows 10 deployment tools reference
|
||||
description: Learn about the tools available to deploy Windows 10.
|
||||
ms.assetid: 5C4B0AE3-B2D0-4628-9E73-606F3FAA17BB
|
||||
ms.reviewer:
|
||||
manager: laurawi
|
||||
ms.audience: itpro
|
||||
author: greg-lindsay
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
audience: itpro
|
||||
author: greg-lindsay
|
||||
ms.date: 07/12/2017
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Windows 10 deployment tools
|
||||
|
||||
Learn about the tools available to deploy Windows 10.
|
||||
|
||||
|Topic |Description |
|
||||
|------|------------|
|
||||
|[Windows 10 deployment scenarios and tools](windows-deployment-scenarios-and-tools.md) |To successfully deploy the Windows 10 operating system and applications for your organization, it is essential that you know about the available tools to help with the process. In this topic, you will learn about the most commonly used tools for Windows 10 deployment. |
|
||||
|[Convert MBR partition to GPT](mbr-to-gpt.md) |This topic provides detailed instructions for using the MBR2GPT partition conversion tool. |
|
||||
|[Configure a PXE server to load Windows PE](configure-a-pxe-server-to-load-windows-pe.md) |This guide describes how to configure a PXE server to load Windows PE by booting a client computer from the network. |
|
||||
|[Windows ADK for Windows 10 scenarios for IT Pros](windows-adk-scenarios-for-it-pros.md) |The Windows Assessment and Deployment Kit (Windows ADK) contains tools that can be used by IT Pros to deploy Windows. |
|
||||
|[Deploy Windows To Go in your organization](deploy-windows-to-go.md) |This topic helps you to deploy Windows To Go in your organization. Before you begin deployment, make sure that you have reviewed the topics [Windows To Go: feature overview](planning/windows-to-go-overview.md) and [Prepare your organization for Windows To Go](planning/prepare-your-organization-for-windows-to-go.md) to ensure that you have the correct hardware and are prepared to complete the deployment. You can then use the steps in this topic to start your Windows To Go deployment. |
|
||||
|[Volume Activation Management Tool (VAMT) Technical Reference](volume-activation/volume-activation-management-tool.md) |The Volume Activation Management Tool (VAMT) enables network administrators and other IT professionals to automate and centrally manage the Windows®, Microsoft® Office, and select other Microsoft products volume and retail-activation process. |
|
||||
|[User State Migration Tool (USMT) Technical Reference](usmt/usmt-technical-reference.md) |The User State Migration Tool (USMT) 10.0 is included with the Windows Assessment and Deployment Kit (Windows ADK) for Windows 10. USMT provides a highly customizable user-profile migration experience for IT professionals |
|
||||
|
||||
@ -1,28 +1,30 @@
|
||||
---
|
||||
title: Windows 10 deployment tools (Windows 10)
|
||||
description: Learn about the tools available to deploy Windows 10.
|
||||
ms.assetid: 5C4B0AE3-B2D0-4628-9E73-606F3FAA17BB
|
||||
ms.reviewer:
|
||||
manager: laurawi
|
||||
ms.audience: itpro
author: greg-lindsay
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
audience: itpro
author: greg-lindsay
|
||||
ms.date: 10/16/2017
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Windows 10 deployment tools
|
||||
|
||||
Learn about the tools available to deploy Windows 10.
|
||||
|
||||
|Topic |Description |
|
||||
|------|------------|
|
||||
|[Windows 10 deployment scenarios and tools](windows-deployment-scenarios-and-tools.md) |To successfully deploy the Windows 10 operating system and applications for your organization, it is essential that you know about the available tools to help with the process. In this topic, you will learn about the most commonly used tools for Windows 10 deployment. |
|
||||
|[Convert MBR partition to GPT](mbr-to-gpt.md) |This topic provides detailed instructions for using the MBR2GPT partition conversion tool. |
|
||||
|[Configure a PXE server to load Windows PE](configure-a-pxe-server-to-load-windows-pe.md) |This guide describes how to configure a PXE server to load Windows PE by booting a client computer from the network. |
|
||||
|[Windows ADK for Windows 10 scenarios for IT Pros](windows-adk-scenarios-for-it-pros.md) |The Windows Assessment and Deployment Kit (Windows ADK) contains tools that can be used by IT Pros to deploy Windows. |
|
||||
|[Deploy Windows To Go in your organization](deploy-windows-to-go.md) |This topic helps you to deploy Windows To Go in your organization. Before you begin deployment, make sure that you have reviewed the topics [Windows To Go: feature overview](planning/windows-to-go-overview.md) and [Prepare your organization for Windows To Go](planning/prepare-your-organization-for-windows-to-go.md) to ensure that you have the correct hardware and are prepared to complete the deployment. You can then use the steps in this topic to start your Windows To Go deployment. |
|
||||
|[Volume Activation Management Tool (VAMT) Technical Reference](volume-activation/volume-activation-management-tool.md) |The Volume Activation Management Tool (VAMT) enables network administrators and other IT professionals to automate and centrally manage the Windows®, Microsoft® Office, and select other Microsoft products volume and retail-activation process. |
|
||||
|[User State Migration Tool (USMT) Technical Reference](usmt/usmt-technical-reference.md) |The User State Migration Tool (USMT) 10.0 is included with the Windows Assessment and Deployment Kit (Windows ADK) for Windows 10. USMT provides a highly customizable user-profile migration experience for IT professionals |
|
||||
---
|
||||
title: Windows 10 deployment tools
|
||||
description: Learn about the tools available to deploy Windows 10.
|
||||
ms.assetid: 5C4B0AE3-B2D0-4628-9E73-606F3FAA17BB
|
||||
ms.reviewer:
|
||||
manager: laurawi
|
||||
ms.audience: itpro
|
||||
author: greg-lindsay
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
audience: itpro
|
||||
author: greg-lindsay
|
||||
ms.date: 10/16/2017
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Windows 10 deployment tools
|
||||
|
||||
Learn about the tools available to deploy Windows 10.
|
||||
|
||||
|Topic |Description |
|
||||
|------|------------|
|
||||
|[Windows 10 deployment scenarios and tools](windows-deployment-scenarios-and-tools.md) |To successfully deploy the Windows 10 operating system and applications for your organization, it is essential that you know about the available tools to help with the process. In this topic, you will learn about the most commonly used tools for Windows 10 deployment. |
|
||||
|[Convert MBR partition to GPT](mbr-to-gpt.md) |This topic provides detailed instructions for using the MBR2GPT partition conversion tool. |
|
||||
|[Configure a PXE server to load Windows PE](configure-a-pxe-server-to-load-windows-pe.md) |This guide describes how to configure a PXE server to load Windows PE by booting a client computer from the network. |
|
||||
|[Windows ADK for Windows 10 scenarios for IT Pros](windows-adk-scenarios-for-it-pros.md) |The Windows Assessment and Deployment Kit (Windows ADK) contains tools that can be used by IT Pros to deploy Windows. |
|
||||
|[Deploy Windows To Go in your organization](deploy-windows-to-go.md) |This topic helps you to deploy Windows To Go in your organization. Before you begin deployment, make sure that you have reviewed the topics [Windows To Go: feature overview](planning/windows-to-go-overview.md) and [Prepare your organization for Windows To Go](planning/prepare-your-organization-for-windows-to-go.md) to ensure that you have the correct hardware and are prepared to complete the deployment. You can then use the steps in this topic to start your Windows To Go deployment. |
|
||||
|[Volume Activation Management Tool (VAMT) Technical Reference](volume-activation/volume-activation-management-tool.md) |The Volume Activation Management Tool (VAMT) enables network administrators and other IT professionals to automate and centrally manage the Windows®, Microsoft® Office, and select other Microsoft products volume and retail-activation process. |
|
||||
|[User State Migration Tool (USMT) Technical Reference](usmt/usmt-technical-reference.md) |The User State Migration Tool (USMT) 10.0 is included with the Windows Assessment and Deployment Kit (Windows ADK) for Windows 10. USMT provides a highly customizable user-profile migration experience for IT professionals |
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Windows Autopilot support
|
||||
ms.reviewer:
|
||||
title: Windows Autopilot FAQ
|
||||
ms.reviewer: This topic provides OEMs, partners, administrators, and end-users with answers to some frequently asked questions about deploying Windows 10 with Windows Autopilot.
|
||||
manager: laurawi
|
||||
description: Support information for Windows Autopilot
|
||||
keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune
|
||||
@ -99,7 +99,7 @@ A [glossary](#glossary) of abbreviations used in this topic is provided at the e
|
||||
|How do I know that I received Autopilot?|You can tell that you received Windows Autopilot (as in the device received a configuration but has not yet applied it) when you skip the selection page (as seen below), and are immediately taken to a generic or customized sign-in page.|
|
||||
|Windows Autopilot didn’t work, what do I do now?| Questions and actions to assist in troubleshooting: Did a screen not get skipped? Did a user end up as an admin when configured not to? Remember that AAD Admins will be local admins regardless of whether Windows Autopilot is configured to disable local admin Collection information – run licensingdiag.exe and send the .cab (Cabinet file) file that is generated to AutopilotHelp@microsoft.com. If possible, collect an ETL from WPR. Often in these cases, users are not signing into the right AAD tenant, or are creating local user accounts. For a complete list of support options, refer to [Windows Autopilot support](autopilot-support.md). |
|
||||
| If an Administrator makes changes to an existing profile, will the changes take effect on devices that have that profile assigned to them that have already been deployed? |No. Windows Autopilot profiles are not resident on the device. They are downloaded during OOBE, the settings defined at the time are applied. Then, the profile is discarded on the device. If the device is re-imaged or reset, the new profile settings will take effect the next time the device goes through OOBE.|
|
||||
|What is the experience if a device isn’t registered or if an IT Admin doesn’t configure Windows Autopilot prior to an end user attempting to self-deploy? |If the device isn’t registered, it will not receive the Windows Autopilot experience and the end user will go through normal OOBE. The Windows Autopilot configurations will NOT be applied until the user runs through OOBE again, after registration. If a device is started before an MDM profile is created, the device will go through standard OOBE experience. The IT Admin would then have to manually enrol that device into the MDM, after which—the next time that device is “reset”—it will go through the Windows Autopilot OOBE experience.|
|
||||
|What is the experience if a device isn’t registered or if an IT Admin doesn’t configure Windows Autopilot prior to an end user attempting to self-deploy? |If the device isn’t registered, it will not receive the Windows Autopilot experience and the end user will go through normal OOBE. The Windows Autopilot configurations will NOT be applied until the user runs through OOBE again, after registration. If a device is started before an MDM profile is created, the device will go through standard OOBE experience. The IT Admin would then have to manually enroll that device into the MDM, after which—the next time that device is “reset”—it will go through the Windows Autopilot OOBE experience.|
|
||||
|What may be a reason why I did not receive a customized sign-in screen during Autopilot? |Tenant branding must be configured in portal.azure.com to receive a customized sign-in experience.|
|
||||
|What happens if a device is registered with Azure AD but does not have an Windows Autopilot profile assigned? |The regular AAD OOBE will occur since no Windows Autopilot profile was assigned to the device.|
|
||||
|How can I collect logs on Autopilot?|The best way to collect logs on Windows Autopilot performance is to collect a Windows Performance Recorder (WPR) trace during OOBE. The XML file (WPRP extension) for this trace may be provided upon request.|
|
||||
@ -132,7 +132,7 @@ A [glossary](#glossary) of abbreviations used in this topic is provided at the e
|
||||
|------------------|-----------------|
|
||||
|If I wipe the machine and restart, will I still receive Windows Autopilot?|Yes, if the device is still registered for Windows Autopilot and is running Windows 10, version 1703 7B and above releases, it will receive the Windows Autopilot experience.|
|
||||
|Can I harvest the device fingerprint on existing machines?|Yes, if the device is running Windows 10, version 1703 and above, you can harvest device fingerprints for registration. There are no plans to backport the functionality to previous releases and no way to harvest them on pre-Windows 10 Windows 10, version 1703 devices that have not been updated to Windows 10, version 1703.|
|
||||
|What is Windows 10, version 1703 7B and why does it matter?| Windows 10, version 1703 7B is a Windows 10, version 1703 image bundled with cumulative updates. To receive Autopilot, clients **must** run Windows 10, version 1703 7B or later. These cumulative updates contain a critical fix for Autopilot. Consider the following:<br><br><I>Windows Autopilot will not apply its profiles to the machine unless AAD credentials match the expected AAD tenant. For the Windows 10, version 1703 release, it was assumed that would be determined by the domain name, so the domain name used to register (for example contoso.com) should match the domain name used to sign in (for example user@contoso.com). But what happens if your tenant has multiple domains (for example us.contoso.com, or fr.contoso.com)? Since these domain names do not match, the device will not be configured for Autopilot. However, both domains are part of the same AAD tenant, and as such it was determined the matching scheme was not useful. This was improved upon by making use of the tenant ID. By using the tenant ID, we can determine that if the user signs into a domain with a tenant matching the one they registered with, we can safely consider this to be a match. The fix for this problem already exists in Windows 10, version 1709 and was backported into the Windows 10, version 1703 7B release.</I> <br><br>**Key Take-Aways**: When using pre-Windows 10, version 1703 7B clients the user’s domain **must** match the domain they registered with. This functionality is found in Windows 10 version 1709 clients using build >= 16215, and Windows 10, version 1703 clients >= 7B. |
|
||||
|What is Windows 10, version 1703 7B and why does it matter?| Windows 10, version 1703 7B is a Windows 10, version 1703 image bundled with cumulative updates. To receive Autopilot, clients **must** run Windows 10, version 1703 7B or later. These cumulative updates contain a critical fix for Autopilot. Consider the following:<br><br><I>Windows Autopilot will not apply its profiles to the machine unless AAD credentials match the expected AAD tenant. For the Windows 10, version 1703 release, it was assumed that would be determined by the domain name, so the domain name used to register (for example contoso.com) should match the domain name used to sign in (for example user@contoso.com). But what happens if your tenant has multiple domains (for example us.contoso.com, or fr.contoso.com)? Since these domain names do not match, the device will not be configured for Autopilot. However, both domains are part of the same AAD tenant, and as such it was determined the matching scheme was not useful. This was improved upon by making use of the tenant ID. By using the tenant ID, we can determine that if the user signs into a domain with a tenant matching the one they registered with, we can safely consider this to be a match. The fix for this problem already exists in Windows 10, version 1709 and was backported into the Windows 10, version 1703 7B release.</I> <br><br>**Key takeaways**: When using pre-Windows 10, version 1703 7B clients the user’s domain **must** match the domain they registered with. This functionality is found in Windows 10 version 1709 clients using build >= 16215, and Windows 10, version 1703 clients >= 7B. |
|
||||
|What is the impact of not updating to 7B?|See the detailed scenario described directly above.|
|
||||
|Is Windows Autopilot supported on other SKUs, e.g. Surface Hub, HoloLens, Windows Mobile.|No, Windows Autopilot isn’t supported on other SKUs.|
|
||||
|Does Windows Autopilot work after MBR or image re-installation?|Yes.|
|
||||
|
||||
@ -25,12 +25,20 @@ ms.topic: article
|
||||
|
||||
<table>
|
||||
<th>Issue<th>More information
|
||||
|
||||
<tr><td>Windows Autopilot device provisioning can fail with TPM attestation errors or ESP timeouts on devices where the real-time clock is off by a significant amount of time (e.g. several minutes or more).</td>
|
||||
<td>To fix this issue: <ol><li>Boot the device to the start of the out-of-box experience (OOBE).
|
||||
<li>Establish a network connection (wired or wireless).
|
||||
<li>Run the command <b>w32tm /resync /force</b> to sync the time with the default time server (time.windows.com).</ol>
|
||||
</tr>
|
||||
|
||||
<tr><td>Windows Autopilot for existing devices does not work for Windows 10, version 1903; you see screens that you've disabled in your Windows Autopilot profile, such as the Windows 10 License Agreement screen.
|
||||
<br> <br>
|
||||
This happens because Windows 10, version 1903 deletes the AutopilotConfigurationFile.json file.
|
||||
<td>To fix this issue: <ol><li>Edit the Configuration Manager task sequence and disable the <b>Prepare Windows for Capture</b> step.
|
||||
<li>Add a new <b>Run command line</b> step that runs <b>c:\windows\system32\sysprep\sysprep.exe /oobe /reboot</b>.</ol>
|
||||
<a href="https://oofhours.com/2019/09/19/a-challenge-with-windows-autopilot-for-existing-devices-and-windows-10-1903/">More information</a>
|
||||
<a href="https://oofhours.com/2019/09/19/a-challenge-with-windows-autopilot-for-existing-devices-and-windows-10-1903/">More information</a></tr>
|
||||
|
||||
<tr><td>TPM attestation fails on Windows 10 1903 due to missing AKI extension in EK certificate. (An additional validation added in Windows 10 1903 to check that the TPM EK certs had the proper attributes according to the TCG specifications uncovered that a number of them don’t, so that validation will be removed).
|
||||
<td>Download and install the <a href="https://support.microsoft.com/help/4517211/windows-10-update-kb4517211">KB4517211 update</a>.
|
||||
<tr><td>The following known issues are resolved by installing the August 30, 2019 KB4512941 update (OS Build 18362.329):
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Windows 10 deployment tools (Windows 10)
|
||||
title: Windows 10 deployment scenarios and tools
|
||||
description: To successfully deploy the Windows 10 operating system and applications for your organization, it is essential that you know about the available tools to help with the process.
|
||||
ms.assetid: 0d6cee1f-14c4-4b69-b29a-43b0b327b877
|
||||
ms.reviewer:
|
||||
|
||||
@ -8,7 +8,7 @@
|
||||
### [Diagnostic Data Viewer Overview](diagnostic-data-viewer-overview.md)
|
||||
### [Diagnostic Data Viewer for PowerShell Overview](Microsoft-DiagnosticDataViewer.md)
|
||||
## Basic level Windows diagnostic data events and fields
|
||||
### [Windows 10, version 1903 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md)
|
||||
### [Windows 10, version 1903 and Windows 10, version 1909 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md)
|
||||
### [Windows 10, version 1809 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md)
|
||||
### [Windows 10, version 1803 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md)
|
||||
### [Windows 10, version 1709 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md)
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
description: Use this article to learn more about what Windows diagnostic data is gathered at the basic level.
|
||||
title: Windows 10, version 1903 basic diagnostic events and fields (Windows 10)
|
||||
title: Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields (Windows 10)
|
||||
keywords: privacy, telemetry
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
@ -13,15 +13,16 @@ manager: dansimp
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
audience: ITPro
|
||||
ms.date: 04/23/2019
|
||||
ms.date: 12/04/2019
|
||||
---
|
||||
|
||||
|
||||
# Windows 10, version 1903 basic level Windows diagnostic events and fields
|
||||
# Windows 10, version 1903 and Windows 10, version 1909 basic level Windows diagnostic events and fields
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10, version 1903
|
||||
- Windows 10, version 1909
|
||||
|
||||
|
||||
The Basic level gathers a limited set of information that is critical for understanding the device and its configuration including: basic device information, quality-related information, app compatibility, and Microsoft Store. When the level is set to Basic, it also includes the Security level information.
|
||||
@ -666,7 +667,7 @@ The following fields are available:
|
||||
- **HasUxBlockOverride** Does the file have a block that is overridden by a tag in the SDB?
|
||||
- **MigApplication** Does the file have a MigXML from the SDB associated with it that applies to the current upgrade mode?
|
||||
- **MigRemoval** Does the file have a MigXML from the SDB that will cause the app to be removed on upgrade?
|
||||
- **NeedsDismissAction** Will the file cause an action that can be dimissed?
|
||||
- **NeedsDismissAction** Will the file cause an action that can be dismissed?
|
||||
- **NeedsInstallPostUpgradeData** After upgrade, the file will have a post-upgrade notification to install a replacement for the app.
|
||||
- **NeedsNotifyPostUpgradeData** Does the file have a notification that should be shown after upgrade?
|
||||
- **NeedsReinstallPostUpgradeData** After upgrade, this file will have a post-upgrade notification to reinstall the app.
|
||||
@ -1469,7 +1470,7 @@ The following fields are available:
|
||||
- **RunAppraiser** Indicates if Appraiser was set to run at all. If this if false, it is understood that data events will not be received from this device.
|
||||
- **RunDate** The date that the telemetry run was stated, expressed as a filetime.
|
||||
- **RunGeneralTel** Indicates if the generaltel.dll component was run. Generaltel collects additional telemetry on an infrequent schedule and only from machines at telemetry levels higher than Basic.
|
||||
- **RunOnline** Indicates if appraiser was able to connect to Windows Update and theefore is making decisions using up-to-date driver coverage information.
|
||||
- **RunOnline** Indicates if appraiser was able to connect to Windows Update and therefore is making decisions using up-to-date driver coverage information.
|
||||
- **RunResult** The hresult of the Appraiser telemetry run.
|
||||
- **ScheduledUploadDay** The day scheduled for the upload.
|
||||
- **SendingUtc** Indicates if the Appraiser client is sending events during the current telemetry run.
|
||||
@ -1678,7 +1679,7 @@ This event sends Windows Insider data from customers participating in improvemen
|
||||
The following fields are available:
|
||||
|
||||
- **DeviceSampleRate** The telemetry sample rate assigned to the device.
|
||||
- **DriverTargetRing** Indicates if the device is participating in receiving pre-release drivers and firmware contrent.
|
||||
- **DriverTargetRing** Indicates if the device is participating in receiving pre-release drivers and firmware content.
|
||||
- **EnablePreviewBuilds** Used to enable Windows Insider builds on a device.
|
||||
- **FlightIds** A list of the different Windows Insider builds on this device.
|
||||
- **FlightingBranchName** The name of the Windows Insider branch currently used by the device.
|
||||
@ -1935,7 +1936,7 @@ This event sends data about the current user's default preferences for browser a
|
||||
The following fields are available:
|
||||
|
||||
- **CalendarType** The calendar identifiers that are used to specify different calendars.
|
||||
- **DefaultApp** The current uer's default program selected for the following extension or protocol: .html, .htm, .jpg, .jpeg, .png, .mp3, .mp4, .mov, .pdf.
|
||||
- **DefaultApp** The current user's default program selected for the following extension or protocol: .html, .htm, .jpg, .jpeg, .png, .mp3, .mp4, .mov, .pdf.
|
||||
- **DefaultBrowserProgId** The ProgramId of the current user's default browser.
|
||||
- **LongDateFormat** The long date format the user has selected.
|
||||
- **ShortDateFormat** The short date format the user has selected.
|
||||
@ -5135,8 +5136,8 @@ The following fields are available:
|
||||
- **DeploymentProviderMode** The mode of operation of the update deployment provider.
|
||||
- **DeviceModel** Device model as defined in the system bios
|
||||
- **EventInstanceID** A globally unique identifier for event instance
|
||||
- **EventScenario** Indicates the purpose of the event - whether because scan started, succeded, failed, etc.
|
||||
- **EventType** Possible values are "Child", "Bundle", "Relase" or "Driver".
|
||||
- **EventScenario** Indicates the purpose of the event - whether because scan started, succeeded, failed, etc.
|
||||
- **EventType** Possible values are "Child", "Bundle", "Release" or "Driver".
|
||||
- **FlightId** The specific id of the flight the device is getting
|
||||
- **HandlerType** Indicates the kind of content (app, driver, windows patch, etc.)
|
||||
- **RevisionNumber** Identifies the revision number of this specific piece of content
|
||||
@ -5241,7 +5242,7 @@ The following fields are available:
|
||||
|
||||
- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client
|
||||
- **ClientVersion** The version number of the software distribution client
|
||||
- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed
|
||||
- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was canceled, succeeded, or failed
|
||||
- **EventType** Possible values are "Child", "Bundle", "Relase" or "Driver"
|
||||
- **ExtendedStatusCode** Secondary error code for certain scenarios where StatusCode wasn't specific enough
|
||||
- **FileId** A hash that uniquely identifies a file
|
||||
@ -5274,7 +5275,7 @@ The following fields are available:
|
||||
- **IsNetworkMetered** Indicates whether Windows considered the current network to be ?metered"
|
||||
- **MOAppDownloadLimit** Mobile operator cap on size of application downloads, if any
|
||||
- **MOUpdateDownloadLimit** Mobile operator cap on size of operating system update downloads, if any
|
||||
- **PowerState** Indicates the power state of the device at the time of heartbeart (DC, AC, Battery Saver, or Connected Standby)
|
||||
- **PowerState** Indicates the power state of the device at the time of heartbeat (DC, AC, Battery Saver, or Connected Standby)
|
||||
- **RelatedCV** The previous correlation vector that was used by the client, before swapping with a new one
|
||||
- **ResumeCount** Number of times this active download has resumed from a suspended state
|
||||
- **RevisionNumber** Identifies the revision number of this specific piece of content
|
||||
@ -5311,7 +5312,7 @@ The following fields are available:
|
||||
- **DriverPingBack** Contains information about the previous driver and system state.
|
||||
- **DriverRecoveryIds** The list of identifiers that could be used for uninstalling the drivers if a recovery is required.
|
||||
- **EventInstanceID** A globally unique identifier for event instance.
|
||||
- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started installing content, or whether it was cancelled, succeeded, or failed.
|
||||
- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started installing content, or whether it was canceled, succeeded, or failed.
|
||||
- **EventType** Possible values are Child, Bundle, or Driver.
|
||||
- **ExtendedErrorCode** The extended error code.
|
||||
- **ExtendedStatusCode** Secondary error code for certain scenarios where StatusCode is not specific enough.
|
||||
@ -5436,7 +5437,7 @@ The following fields are available:
|
||||
- **DriverPingBack** Contains information about the previous driver and system state.
|
||||
- **DriverRecoveryIds** The list of identifiers that could be used for uninstalling the drivers when a recovery is required.
|
||||
- **EventInstanceID** A globally unique identifier for event instance.
|
||||
- **EventScenario** Indicates the purpose of the event (a scan started, succeded, failed, etc.).
|
||||
- **EventScenario** Indicates the purpose of the event (a scan started, succeeded, failed, etc.).
|
||||
- **EventType** Indicates the event type. Possible values are "Child", "Bundle", "Release" or "Driver".
|
||||
- **ExtendedStatusCode** Secondary status code for certain scenarios where StatusCode is not specific enough.
|
||||
- **FeatureUpdatePause** Indicates whether feature OS updates are paused on the device.
|
||||
@ -5488,7 +5489,7 @@ The following fields are available:
|
||||
|
||||
- **CallerApplicationName** Name of application making the Windows Update request. Used to identify context of request.
|
||||
- **EndpointUrl** URL of the endpoint where client obtains update metadata. Used to identify test vs staging vs production environments.
|
||||
- **EventScenario** Indicates the purpose of the event - whether because scan started, succeded, failed, etc.
|
||||
- **EventScenario** Indicates the purpose of the event - whether because scan started, succeeded, failed, etc.
|
||||
- **ExtendedStatusCode** Secondary status code for certain scenarios where StatusCode was not specific enough.
|
||||
- **LeafCertId** The integral ID from the FragmentSigning data for the certificate that failed.
|
||||
- **ListOfSHA256OfIntermediateCerData** A semicolon delimited list of base64 encoding of hashes for the Base64CerData in the FragmentSigning data of an intermediate certificate.
|
||||
@ -5515,7 +5516,7 @@ The following fields are available:
|
||||
|
||||
### Microsoft.Windows.SysReset.FlightUninstallCancel
|
||||
|
||||
This event indicates the customer has cancelled uninstallation of Windows.
|
||||
This event indicates the customer has canceled uninstallation of Windows.
|
||||
|
||||
|
||||
|
||||
@ -6019,7 +6020,7 @@ The following fields are available:
|
||||
- **Setup360Result** The result of Setup360 (HRESULT used to diagnose errors).
|
||||
- **Setup360Scenario** The Setup360 flow type (for example, Boot, Media, Update, MCT).
|
||||
- **SetupVersionBuildNumber** The build number of Setup360 (build number of the target OS).
|
||||
- **State** Exit state of given Setup360 run. Example: succeeded, failed, blocked, cancelled.
|
||||
- **State** Exit state of given Setup360 run. Example: succeeded, failed, blocked, canceled.
|
||||
- **TestId** An ID that uniquely identifies a group of events.
|
||||
- **WuId** This is the Windows Update Client ID. In the Windows Update scenario, this is the same as the clientId.
|
||||
|
||||
@ -6041,7 +6042,7 @@ The following fields are available:
|
||||
- **Setup360Result** The result of Setup360. This is an HRESULT error code that is used to diagnose errors.
|
||||
- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT.
|
||||
- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
|
||||
- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled.
|
||||
- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, canceled.
|
||||
- **TestId** ID that uniquely identifies a group of events.
|
||||
- **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as the clientId.
|
||||
|
||||
@ -6063,7 +6064,7 @@ The following fields are available:
|
||||
- **Setup360Result** The result of Setup360. This is an HRESULT error code that is used to diagnose errors.
|
||||
- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT
|
||||
- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
|
||||
- **State** Exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled.
|
||||
- **State** Exit state of a Setup360 run. Example: succeeded, failed, blocked, canceled.
|
||||
- **TestId** ID that uniquely identifies a group of events.
|
||||
- **WuId** Windows Update client ID.
|
||||
|
||||
@ -6085,7 +6086,7 @@ The following fields are available:
|
||||
- **Setup360Result** The result of Setup360. This is an HRESULT error code that's used to diagnose errors.
|
||||
- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT
|
||||
- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
|
||||
- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled
|
||||
- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, canceled
|
||||
- **TestId** A string to uniquely identify a group of events.
|
||||
- **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as ClientId.
|
||||
|
||||
@ -6129,7 +6130,7 @@ The following fields are available:
|
||||
- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used to diagnose errors.
|
||||
- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT.
|
||||
- **SetupVersionBuildNumber** The build number of Setup360 (build number of the target OS).
|
||||
- **State** The exit state of the Setup360 run. Example: succeeded, failed, blocked, cancelled.
|
||||
- **State** The exit state of the Setup360 run. Example: succeeded, failed, blocked, canceled.
|
||||
- **TestId** ID that uniquely identifies a group of events.
|
||||
- **WuId** Windows Update client ID.
|
||||
|
||||
@ -6151,7 +6152,7 @@ The following fields are available:
|
||||
- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used to diagnose errors.
|
||||
- **Setup360Scenario** Setup360 flow type (Boot, Media, Update, MCT).
|
||||
- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
|
||||
- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled.
|
||||
- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, canceled.
|
||||
- **TestId** A string to uniquely identify a group of events.
|
||||
- **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as the clientId.
|
||||
|
||||
@ -6173,7 +6174,7 @@ The following fields are available:
|
||||
- **Setup360Result** The result of Setup360. This is an HRESULT error code that is used to diagnose errors.
|
||||
- **Setup360Scenario** The Setup360 flow type, Example: Boot, Media, Update, MCT.
|
||||
- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
|
||||
- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled.
|
||||
- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, canceled.
|
||||
- **TestId** A string to uniquely identify a group of events.
|
||||
- **WuId** Windows Update client ID.
|
||||
|
||||
@ -6288,7 +6289,7 @@ The following fields are available:
|
||||
- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used to diagnose errors.
|
||||
- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT.
|
||||
- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
|
||||
- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled.
|
||||
- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, canceled.
|
||||
- **TestId** A string to uniquely identify a group of events.
|
||||
- **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as the clientId.
|
||||
|
||||
@ -6330,7 +6331,7 @@ The following fields are available:
|
||||
|
||||
### Microsoft.Windows.WERVertical.OSCrash
|
||||
|
||||
This event sends binary data from the collected dump file wheneveer a bug check occurs, to help keep Windows up to date. The is the OneCore version of this event.
|
||||
This event sends binary data from the collected dump file whenever a bug check occurs, to help keep Windows up to date. The is the OneCore version of this event.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
@ -6793,12 +6794,12 @@ The following fields are available:
|
||||
|
||||
- **CatalogId** The Store Catalog ID for the product being installed.
|
||||
- **ProductId** The Store Product ID for the product being installed.
|
||||
- **SkuId** Specfic edition of the app being updated.
|
||||
- **SkuId** Specific edition of the app being updated.
|
||||
|
||||
|
||||
### Microsoft.Windows.StoreAgent.Telemetry.StateTransition
|
||||
|
||||
Products in the process of being fulfilled (installed or updated) are maintained in a list. This event is sent any time there is a change in a product's fulfillment status (pending, working, paused, cancelled, or complete), to help keep Windows up to date and secure.
|
||||
Products in the process of being fulfilled (installed or updated) are maintained in a list. This event is sent any time there is a change in a product's fulfillment status (pending, working, paused, canceled, or complete), to help keep Windows up to date and secure.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
@ -7177,7 +7178,7 @@ The following fields are available:
|
||||
- **detectionBlockreason** The reason detection did not complete.
|
||||
- **detectionRetryMode** Indicates whether we will try to scan again.
|
||||
- **errorCode** The error code returned for the current process.
|
||||
- **eventScenario** End-to-end update session ID, or indicates the purpose of sending this event - whether because the software distribution just started installing content, or whether it was cancelled, succeeded, or failed.
|
||||
- **eventScenario** End-to-end update session ID, or indicates the purpose of sending this event - whether because the software distribution just started installing content, or whether it was canceled, succeeded, or failed.
|
||||
- **flightID** The specific ID of the Windows Insider build the device is getting.
|
||||
- **interactive** Indicates whether the session was user initiated.
|
||||
- **networkStatus** Error info
|
||||
@ -7215,7 +7216,7 @@ This event indicates the reboot was postponed due to needing a display.
|
||||
The following fields are available:
|
||||
|
||||
- **displayNeededReason** Reason the display is needed.
|
||||
- **eventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed.
|
||||
- **eventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was canceled, succeeded, or failed.
|
||||
- **rebootOutsideOfActiveHours** Indicates whether the reboot was to occur outside of active hours.
|
||||
- **revisionNumber** Revision number of the update.
|
||||
- **updateId** Update ID.
|
||||
@ -7310,7 +7311,7 @@ The following fields are available:
|
||||
|
||||
- **batteryLevel** Current battery capacity in mWh or percentage left.
|
||||
- **deferReason** Reason for install not completing.
|
||||
- **errorCode** The error code reppresented by a hexadecimal value.
|
||||
- **errorCode** The error code represented by a hexadecimal value.
|
||||
- **eventScenario** End-to-end update session ID.
|
||||
- **flightID** The ID of the Windows Insider build the device is getting.
|
||||
- **flightUpdate** Indicates whether the update is a Windows Insider build.
|
||||
|
||||
@ -142,13 +142,25 @@ The data transmitted at the Basic and Enhanced data diagnostic levels is quite s
|
||||
|
||||
The Microsoft Data Management Service routes data back to our secure cloud storage. Only Microsoft personnel with a valid business justification are permitted access.
|
||||
|
||||
Solutions like Desktop Analytics or Microsoft Defender Advanced Threat Protection need Windows devices to reach diagnostics endpoints which enable organizations to leverage solutions based on diagnostics data. These solutions leverage Windows components like the Connected User Experiences and Telemetry service, Windows Defender Advanced Threat Protection service, Windows Error Reporting, and Online Crash Analysis.
|
||||
|
||||
For a complete list of diagnostics endpoints leveraged by Desktop Analytics, see [Enable data sharing for Desktop Analytics](https://docs.microsoft.com/configmgr/desktop-analytics/enable-data-sharing).
|
||||
For a complete list of diagnostics endpoints leveraged by Microsoft Defender Advanced Threat Protection, see [Enable access to Microsoft Defender ATP service URLs in the proxy server](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet#enable-access-to-microsoft-defender-atp-service-urls-in-the-proxy-server).
|
||||
|
||||
The following table defines the endpoints for Connected User Experiences and Telemetry component:
|
||||
|
||||
Windows release | Endpoint
|
||||
--- | ---
|
||||
Windows 10, versions 1703 or later, with the 2018-09 cumulative update installed| **Diagnostics data** - v10c.vortex-win.data.microsoft.com</br></br>**Functional** - v20.vortex-win.data.microsoft.com</br>**Microsoft Defender Advanced Threat Protection** is country specific and the prefix changes by country for example: **de**.vortex-win.data.microsoft.com</br>**Settings** - win.data.microsoft.com
|
||||
Windows 10, versions 1803 or later, without the 2018-09 cumulative update installed | **Diagnostics data** - v10.events.data.microsoft.com</br></br>**Functional** - v20.vortex-win.data.microsoft.com</br>**Microsoft Defender Advanced Threat Protection** is country specific and the prefix changes by country for example: **de**.vortex-win.data.microsoft.com</br>**Settings** - win.data.microsoft.com
|
||||
Windows 10, version 1709 or earlier | **Diagnostics data** - v10.vortex-win.data.microsoft.com</br></br>**Functional** - v20.vortex-win.data.microsoft.com</br>**Microsoft Defender Advanced Threat Protection** is country specific and the prefix changes by country for example: **de**.vortex-win.data.microsoft.com</br>**Settings** - win.data.microsoft.com
|
||||
| Windows release | Endpoint |
|
||||
| ----------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------- |
|
||||
| Windows 10, versions 1703 or later, with the 2018-09 cumulative update installed | **Diagnostics data:** v10c.vortex-win.data.microsoft.com</br></br>**Functional:** v20.vortex-win.data.microsoft.com</br></br>**Microsoft Defender Advanced Threat Protection** is country specific and the prefix changes by country,</br>for example: **de**.vortex-win.data.microsoft.com</br></br>**Settings:** settings-win.data.microsoft.com |
|
||||
| Windows 10, versions 1803 or later, without the 2018-09 cumulative update installed | **Diagnostics data:** v10.events.data.microsoft.com</br></br>**Functional:** v20.vortex-win.data.microsoft.com</br></br>**Microsoft Defender Advanced Threat Protection** is country specific and the prefix changes by country,</br>for example: **de**.vortex-win.data.microsoft.com</br></br>**Settings:** settings-win.data.microsoft.com |
|
||||
| Windows 10, version 1709 or earlier | **Diagnostics data:** v10.vortex-win.data.microsoft.com</br></br>**Functional:** v20.vortex-win.data.microsoft.com</br></br>**Microsoft Defender Advanced Threat Protection** is country specific and the prefix changes by country,</br>for example: **de**.vortex-win.data.microsoft.com</br></br>**Settings:** settings-win.data.microsoft.com |
|
||||
|
||||
The following table defines **additional diagnostics endpoints** not covered by services in the links above:
|
||||
|
||||
| Service | Endpoint |
|
||||
| ----------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------- |
|
||||
| Onedrive app for Windows 10 | https://vortex.data.microsoft.com/collect/v1 |
|
||||
|
||||
|
||||
The following table defines the endpoints for other diagnostic data services:
|
||||
|
||||
@ -385,7 +397,7 @@ In Windows 10, version 1709, we introduced the **Limit Enhanced diagnostic data
|
||||
|
||||
- **Some crash dump types.** Triage dumps for user mode and mini dumps for kernel mode.
|
||||
|
||||
>[!NOTE]
|
||||
> [!NOTE]
|
||||
> Triage dumps are a type of [minidumps](https://docs.microsoft.com/windows/desktop/debug/minidump-files) that go through a process of user-sensitive information scrubbing. Some user-sensitive information may be missed in the process, and will therefore be sent with the dump.
|
||||
|
||||
With the retirement of Windows Analytics, this policy will continue to be supported by Desktop Analytics, but will not include Office related diagnostic data.
|
||||
|
||||
@ -44,8 +44,8 @@ Before you can use this tool for viewing Windows diagnostic data, you must turn
|
||||
### Download the Diagnostic Data Viewer
|
||||
Download the app from the [Microsoft Store Diagnostic Data Viewer](https://www.microsoft.com/store/p/diagnostic-data-viewer/9n8wtrrsq8f7?rtc=1) page.
|
||||
|
||||
>[!Important]
|
||||
>It's possible that your Windows device doesn't have the Microsoft Store available (for example, Windows Server). If this is the case, see [Diagnostic Data Viewer for PowerShell](https://go.microsoft.com/fwlink/?linkid=2094264).
|
||||
> [!Important]
|
||||
> It's possible that your Windows device doesn't have the Microsoft Store available (for example, Windows Server). If this is the case, see [Diagnostic Data Viewer for PowerShell](https://go.microsoft.com/fwlink/?linkid=2094264).
|
||||
|
||||
### Start the Diagnostic Data Viewer
|
||||
You can start this app from the **Settings** panel.
|
||||
@ -118,17 +118,15 @@ When you're done reviewing your diagnostic data, you should turn of data viewing
|
||||
## Modifying the size of your data history
|
||||
By default, Diagnostic Data Viewer shows you up to 1GB or 30 days of data (whichever comes first) for Windows diagnostic data. Once either the time or space limit is reached, the data is incrementally dropped with the oldest data points dropped first.
|
||||
|
||||
>[!Important]
|
||||
>Note that if you have [Office diagnostic data viewing enabled](#view-office-diagnostic-data), the Office data history is fixed at 1 GB and cannot be modified.
|
||||
> [!Important]
|
||||
> Note that if you have [Office diagnostic data viewing enabled](#view-office-diagnostic-data), the Office data history is fixed at 1 GB and cannot be modified.
|
||||
|
||||
**Modify the size of your data history**
|
||||
|
||||
To make changes to the size of your Windows diagnostic data history, visit the **app settings**, located at the bottom of the navigation menu. Data will be incrementally dropped with the oldest data points first once your chosen size or time limit is reached.
|
||||
To make changes to the size of your Windows diagnostic data history, visit the **app settings**, located at the bottom of the navigation menu. Data will be incrementally dropped with the oldest data points first once your chosen size or time limit is reached.
|
||||
|
||||
>[!Important]
|
||||
>Decreasing the maximum amount of diagnostic data viewable through the tool will remove all data history and requires a reboot of your device. Additionally, increasing the maximum amount of diagnostic data viewable by the tool may come with performance impacts to your machine.
|
||||
|
||||
|
||||
> [!Important]
|
||||
> Decreasing the maximum amount of diagnostic data viewable through the tool will remove all data history and requires a reboot of your device. Additionally, increasing the maximum amount of diagnostic data viewable by the tool may come with performance impacts to your machine.
|
||||
|
||||
## View additional diagnostic data in the View problem reports tool
|
||||
Available on Windows 1809 and higher, you can review additional Windows Error Reporting diagnostic data in the **View problem reports** page within the Diagnostic Data Viewer.
|
||||
|
||||
@ -67,7 +67,7 @@ For Windows 10, the following MDM policies are available in the [Policy CSP](htt
|
||||
|
||||
1. **Internet Explorer** The following Microsoft Internet Explorer MDM policies are available in the [Internet Explorer CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer)
|
||||
1. MDM Policy: [InternetExplorer/AllowSuggestedSites](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-allowsuggestedsites). Recommends websites based on the user’s browsing activity. **Set to Disabled**
|
||||
1. MDM Policy: [InternetExplorer/PreventManagingSmartScreenFilter]( https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-preventmanagingsmartscreenfilter). Prevents the user from managing SmartScreen Filter, which warns the user if the website being visited is known for fraudulent attempts to gather personal information through "phishing," or is known to host malware. **Set to String** with Value:
|
||||
1. MDM Policy: [InternetExplorer/PreventManagingSmartScreenFilter]( https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-preventmanagingsmartscreenfilter). Prevents the user from managing Windows Defender SmartScreen, which warns the user if the website being visited is known for fraudulent attempts to gather personal information through "phishing," or is known to host malware. **Set to String** with Value:
|
||||
1. **\<enabled/>\<data id=”IE9SafetyFilterOptions” value=”1”/>**
|
||||
1. MDM Policy: [InternetExplorer/DisableFlipAheadFeature]( https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-disableflipaheadfeature). Determines whether a user can swipe across a screen or click Forward to go to the next pre-loaded page of a website. **Set to Enabled**
|
||||
1. MDM Policy: [InternetExplorer/DisableHomePageChange]( https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-disablehomepagechange). Determines whether users can change the default Home Page or not. **Set to String** with Value:
|
||||
@ -90,7 +90,7 @@ For Windows 10, the following MDM policies are available in the [Policy CSP](htt
|
||||
1. MDM Policy: [Browser/AllowMicrosoftCompatbilityList](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowmicrosoftcompatibilitylist). Specify the Microsoft compatibility list in Microsoft Edge. **Set to 0 (zero)**
|
||||
1. MDM Policy: [Browser/AllowPasswordManager](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowpasswordmanager). Choose whether employees can save passwords locally on their devices. **Set to 0 (zero)**
|
||||
1. MDM Policy: [Browser/AllowSearchSuggestionsinAddressBar](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowsearchsuggestionsinaddressbar). Choose whether the Address Bar shows search suggestions. **Set to 0 (zero)**
|
||||
1. MDM Policy: [Browser/AllowSmartScreen](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowsmartscreen). Choose whether SmartScreen is turned on or off. **Set to 0 (zero)**
|
||||
1. MDM Policy: [Browser/AllowSmartScreen](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowsmartscreen). Choose whether Windows Defender SmartScreen is turned on or off. **Set to 0 (zero)**
|
||||
|
||||
1. **Network Connection Status Indicator**
|
||||
1. [Connectivity/DisallowNetworkConnectivityActiveTests](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-connectivity#connectivity-disallownetworkconnectivityactivetests). Note: After you apply this policy you must restart the device for the policy setting to take effect. **Set to 1 (one)**
|
||||
|
||||
@ -417,7 +417,7 @@ To turn off Insider Preview builds for Windows 10:
|
||||
| Allow Microsoft services to provide enhanced suggestions as the user types in the Address Bar | Choose whether an employee can configure enhanced suggestions, which are presented to the employee as they type in the Address Bar. <br /> **Set Value to: Disabled**|
|
||||
| Turn off the auto-complete feature for web addresses | Choose whether auto-complete suggests possible matches when employees are typing web address in the Address Bar. <br /> **Set Value to: Enabled** </br> You can also turn this off in the UI by clearing the <strong>Internet Options</strong> > **Advanced** > **Use inline AutoComplete in the Internet Explorer Address Bar and Open Dialog** check box.|
|
||||
| Turn off browser geolocation | Choose whether websites can request location data from Internet Explorer. <br /> **Set Value to: Enabled**|
|
||||
| Prevent managing SmartScreen filter | Choose whether employees can manage the SmartScreen Filter in Internet Explorer. <br /> **Set Value to: Enabled** and then set **Select SmartScreen filtering mode** to **Off**.|
|
||||
| Prevent managing Windows Defender SmartScreen | Choose whether employees can manage the Windows Defender SmartScreen in Internet Explorer. <br /> **Set Value to: Enabled** and then set **Select Windows Defender SmartScreen mode** to **Off**.|
|
||||
|
||||
|
||||
| Registry Key | Registry path |
|
||||
@ -426,7 +426,7 @@ To turn off Insider Preview builds for Windows 10:
|
||||
| Allow Microsoft services to provide enhanced suggestions as the user types in the Address Bar | HKLM\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer<br />REG_DWORD: AllowServicePoweredQSA <br />**Set Value to: 0**|
|
||||
| Turn off the auto-complete feature for web addresses |HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\CurrentVersion\\Explorer\\AutoComplete<br/>REG_SZ: AutoSuggest <br />Set Value to: **no** |
|
||||
| Turn off browser geolocation | HKLM\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Geolocation<br/>REG_DWORD: PolicyDisableGeolocation <br />**Set Value to: 1** |
|
||||
| Prevent managing SmartScreen filter | HKLM\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\PhishingFilter<br/>REG_DWORD: EnabledV9 <br />**Set Value to: 0** |
|
||||
| Prevent managing Windows Defender SmartScreen | HKLM\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\PhishingFilter<br/>REG_DWORD: EnabledV9 <br />**Set Value to: 0** |
|
||||
|
||||
There are more Group Policy objects that are used by Internet Explorer:
|
||||
|
||||
@ -577,7 +577,7 @@ Alternatively, you can configure the following Registry keys as described:
|
||||
| Configure Do Not Track | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main<br/>REG_DWORD name: DoNotTrack<br/> REG_DWORD: **1** |
|
||||
| Configure Password Manager | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main<br/>REG_SZ name: FormSuggest Passwords<br /> REG_SZ: **No** |
|
||||
| Configure search suggestions in Address Bar | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\SearchScopes<br/>REG_DWORD name: ShowSearchSuggestionsGlobal <br />Value: **0**|
|
||||
| Configure Windows Defender SmartScreen Filter (Windows 10, version 1703) | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\PhishingFilter<br/>REG_DWORD name: EnabledV9 <br/>Value: **0** |
|
||||
| Configure Windows Defender SmartScreen (Windows 10, version 1703) | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\PhishingFilter<br/>REG_DWORD name: EnabledV9 <br/>Value: **0** |
|
||||
| Allow web content on New Tab page | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\ServiceUI<br/>REG_DWORD name: AllowWebContentOnNewTabPage <br/>Value: **0** |
|
||||
| Configure corporate Home pages | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Internet Settings<br/>REG_SZ name: ProvisionedHomePages <br/>Value: **<<about:blank>>**|
|
||||
| Prevent the First Run webpage from opening on Microsoft Edge | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main <br>REG_DWORD name: PreventFirstRunPage <br/>Value: **1**|
|
||||
@ -875,7 +875,7 @@ To turn off **Let apps use my advertising ID for experiences across apps (turnin
|
||||
|
||||
- Create a REG_DWORD registry setting named **DisabledByGroupPolicy** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\AdvertisingInfo** with a value of 1 (one).
|
||||
|
||||
To turn off **Turn on SmartScreen Filter to check web content (URLs) that Microsoft Store apps use**:
|
||||
To turn off **Turn on Windows Defender SmartScreen to check web content (URLs) that Microsoft Store apps use**:
|
||||
|
||||
- Turn off the feature in the UI.
|
||||
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Connection endpoints for Windows 10, version 1709
|
||||
title: Connection endpoints for Windows 10 Enterprise, version 1709
|
||||
description: Explains what Windows 10 endpoints are used for, how to turn off traffic to them, and the impact.
|
||||
keywords: privacy, manage connections to Microsoft, Windows 10, Windows Server 2016
|
||||
ms.prod: w10
|
||||
@ -15,11 +15,11 @@ ms.topic: article
|
||||
ms.date: 6/26/2018
|
||||
ms.reviewer:
|
||||
---
|
||||
# Manage connection endpoints for Windows 10, version 1709
|
||||
# Manage connection endpoints for Windows 10 Enterprise, version 1709
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10, version 1709
|
||||
- Windows 10 Enterprise, version 1709
|
||||
|
||||
Some Windows components, app, and related services transfer data to Microsoft network endpoints. Some examples include:
|
||||
|
||||
|
||||
@ -15,11 +15,11 @@ ms.topic: article
|
||||
ms.date: 6/26/2018
|
||||
ms.reviewer:
|
||||
---
|
||||
# Manage connection endpoints for Windows 10, version 1803
|
||||
# Manage connection endpoints for Windows 10 Enterprise, version 1803
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10, version 1803
|
||||
- Windows 10 Enterprise, version 1803
|
||||
|
||||
Some Windows components, app, and related services transfer data to Microsoft network endpoints. Some examples include:
|
||||
|
||||
|
||||
@ -15,11 +15,11 @@ ms.topic: article
|
||||
ms.date: 6/26/2018
|
||||
ms.reviewer:
|
||||
---
|
||||
# Manage connection endpoints for Windows 10, version 1809
|
||||
# Manage connection endpoints for Windows 10 Enterprise, version 1809
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10, version 1809
|
||||
- Windows 10 Enterprise, version 1809
|
||||
|
||||
Some Windows components, app, and related services transfer data to Microsoft network endpoints. Some examples include:
|
||||
|
||||
@ -413,7 +413,7 @@ If you [turn off traffic for these endpoints](manage-connections-from-windows-op
|
||||
|MpCmdRun.exe|HTTPS|go.microsoft.com |
|
||||
|
||||
The following endpoints are used for Windows Defender Smartscreen reporting and notifications.
|
||||
If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-defender-smartscreen), Smartscreen notifications will no appear.
|
||||
If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-defender-smartscreen), Windows Defender Smartscreen notifications will no appear.
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
|
||||
@ -169,7 +169,6 @@ The following methodology was used to derive these network endpoints:
|
||||
|||HTTPS|*.update.microsoft.com|
|
||||
||The following endpoint is used for content regulation. If you turn off traffic for this endpoint, the Windows Update Agent will be unable to contact the endpoint and fallback behavior will be used. This may result in content being either incorrectly.|HTTPS|tsfe.trafficshaping.dsp.mp.microsoft.com|
|
||||
|
||||
|
||||
## Other Windows 10 editions
|
||||
|
||||
To view endpoints for other versions of Windows 10 Enterprise, see:
|
||||
|
||||
@ -12,13 +12,14 @@ ms.author: dansimp
|
||||
manager: dansimp
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 04/15/2019
|
||||
ms.date: 12/04/2019
|
||||
ms.reviewer:
|
||||
---
|
||||
|
||||
# Windows 10, version 1709 and newer diagnostic data for the Full level
|
||||
|
||||
Applies to:
|
||||
- Windows 10, version 1909
|
||||
- Windows 10, version 1903
|
||||
- Windows 10, version 1809
|
||||
- Windows 10, version 1803
|
||||
@ -248,7 +249,7 @@ This type of data includes details about the health of the device, operating sys
|
||||
[Pseudonymized](#pseudo) Product and Service Performance data from Windows 10 is used by Microsoft to [provide](#provide) and [improve](#improve) Windows 10 and related Microsoft product and services. For example:
|
||||
|
||||
- Data about the reliability of content that appears in the [Windows Spotlight](https://docs.microsoft.com/windows/configuration/windows-spotlight) (rotating lock screen images) is used for Windows Spotlight reliability investigations.
|
||||
- Timing data about how quickly Cortana responds to voice commands is used to improve Cortana listening peformance.
|
||||
- Timing data about how quickly Cortana responds to voice commands is used to improve Cortana listening performance.
|
||||
- Timing data about how quickly the facial recognition feature starts up and finishes is used to improve facial recognition performance.
|
||||
- Data about when an Application Window fails to appear is used to investigate issues with Application Window reliability and performance.
|
||||
|
||||
|
||||
@ -16,15 +16,15 @@ ms.date: 08/17/2017
|
||||
ms.reviewer:
|
||||
---
|
||||
|
||||
## Additional mitigations
|
||||
# Additional mitigations
|
||||
|
||||
Windows Defender Credential Guard can provide mitigations against attacks on derived credentials and prevent the use of stolen credentials elsewhere. However, PCs can still be vulnerable to certain attacks, even if the derived credentials are protected by Windows Defender Credential Guard. These attacks can include abusing privileges and use of derived credentials directly from a compromised device, re-using previously stolen credentials prior to Windows Defender Device Guard, and abuse of management tools and weak application configurations. Because of this, additional mitigations also must be deployed to make the domain environment more robust.
|
||||
|
||||
### Restricting domain users to specific domain-joined devices
|
||||
## Restricting domain users to specific domain-joined devices
|
||||
|
||||
Credential theft attacks allow the attacker to steal secrets from one device and use them from another device. If a user can sign on to multiple devices then any device could be used to steal credentials. How do you ensure that users only sign on using devices that have Windows Defender Credential Guard enabled? By deploying authentication policies that restrict them to specific domain-joined devices that have been configured with Windows Defender Credential Guard. For the domain controller to know what device a user is signing on from, Kerberos armoring must be used.
|
||||
|
||||
#### Kerberos armoring
|
||||
### Kerberos armoring
|
||||
|
||||
Kerberos armoring is part of RFC 6113. When a device supports Kerberos armoring, its TGT is used to protect the user's proof of possession which can mitigate offline dictionary attacks. Kerberos armoring also provides the additional benefit of signed KDC errors this mitigates tampering which can result in things such as downgrade attacks.
|
||||
|
||||
@ -34,7 +34,7 @@ Kerberos armoring is part of RFC 6113. When a device supports Kerberos armoring,
|
||||
- All the domain controllers in these domains must be configured to support Kerberos armoring. Set the **KDC support for claims, compound authentication, and Kerberos armoring** Group Policy setting to either **Supported** or **Always provide claims**.
|
||||
- All the devices with Windows Defender Credential Guard that the users will be restricted to must be configured to support Kerberos armoring. Enable the **Kerberos client support for claims, compound authentication and Kerberos armoring** Group Policy settings under **Computer Configuration** -> **Administrative Templates** -> **System** -> **Kerberos**.
|
||||
|
||||
#### Protecting domain-joined device secrets
|
||||
### Protecting domain-joined device secrets
|
||||
|
||||
Since domain-joined devices also use shared secrets for authentication, attackers can steal those secrets as well. By deploying device certificates with Windows Defender Credential Guard, the private key can be protected. Then authentication policies can require that users sign on devices that authenticate using those certificates. This prevents shared secrets stolen from the device to be used with stolen user credentials to sign on as the user.
|
||||
|
||||
@ -46,7 +46,7 @@ Domain-joined device certificate authentication has the following requirements:
|
||||
- Windows 10 devices have the CA issuing the domain controller certificates in the enterprise store.
|
||||
- A process is established to ensure the identity and trustworthiness of the device in a similar manner as you would establish the identity and trustworthiness of a user before issuing them a smartcard.
|
||||
|
||||
##### Deploying domain-joined device certificates
|
||||
#### Deploying domain-joined device certificates
|
||||
|
||||
To guarantee that certificates with the required issuance policy are only installed on the devices these users must use, they must be deployed manually on each device. The same security procedures used for issuing smart cards to users should be applied to device certificates.
|
||||
|
||||
@ -78,7 +78,7 @@ CertReq -EnrollCredGuardCert MachineAuthentication
|
||||
> [!NOTE]
|
||||
> You must restart the device after enrolling the machine authentication certificate.
|
||||
|
||||
##### How a certificate issuance policy can be used for access control
|
||||
#### How a certificate issuance policy can be used for access control
|
||||
|
||||
Beginning with the Windows Server 2008 R2 domain functional level, domain controllers support for authentication mechanism assurance provides a way to map certificate issuance policy OIDs to universal security groups. Windows Server 2012 domain controllers with claim support can map them to claims. To learn more about authentication mechanism assurance, see [Authentication Mechanism Assurance for AD DS in Windows Server 2008 R2 Step-by-Step Guide](https://technet.microsoft.com/library/dd378897(v=ws.10).aspx) on TechNet.
|
||||
|
||||
@ -100,7 +100,7 @@ Beginning with the Windows Server 2008 R2 domain functional level, domain contro
|
||||
.\set-IssuancePolicyToGroupLink.ps1 –IssuancePolicyName:"<name of issuance policy>" –groupOU:"<Name of OU to create>" –groupName:”<name of Universal security group to create>"
|
||||
```
|
||||
|
||||
#### Restricting user sign on
|
||||
### Restricting user sign on
|
||||
|
||||
So we now have completed the following:
|
||||
|
||||
@ -129,17 +129,17 @@ Authentication policies have the following requirements:
|
||||
> [!NOTE]
|
||||
> When the authentication policy enforces policy restrictions, users will not be able to sign on using devices that do not have a certificate with the appropriate issuance policy deployed. This applies to both local and remote sign on scenarios. Therefore, it is strongly recommended to first only audit policy restrictions to ensure you don't have unexpected failures.
|
||||
|
||||
##### Discovering authentication failures due to authentication policies
|
||||
#### Discovering authentication failures due to authentication policies
|
||||
|
||||
To make tracking authentication failures due to authentication policies easier, an operational log exists with just those events. To enable the logs on the domain controllers, in Event Viewer, navigate to **Applications and Services Logs\\Microsoft\\Windows\\Authentication, right-click AuthenticationPolicyFailures-DomainController**, and then click **Enable Log**.
|
||||
|
||||
To learn more about authentication policy events, see [Authentication Policies and Authentication Policy Silos](https://technet.microsoft.com/library/dn486813(v=ws.11).aspx).
|
||||
|
||||
### Appendix: Scripts
|
||||
## Appendix: Scripts
|
||||
|
||||
Here is a list of scripts mentioned in this topic.
|
||||
|
||||
#### <a href="" id="bkmk-getscript"></a>Get the available issuance policies on the certificate authority
|
||||
### <a href="" id="bkmk-getscript"></a>Get the available issuance policies on the certificate authority
|
||||
|
||||
Save this script file as get-IssuancePolicy.ps1.
|
||||
|
||||
@ -330,7 +330,7 @@ write-host "There are no issuance policies which are not mapped to groups"
|
||||
> [!NOTE]
|
||||
> If you're having trouble running this script, try replacing the single quote after the ConvertFrom-StringData parameter.
|
||||
|
||||
#### <a href="" id="bkmk-setscript"></a>Link an issuance policy to a group
|
||||
### <a href="" id="bkmk-setscript"></a>Link an issuance policy to a group
|
||||
|
||||
Save the script file as set-IssuancePolicyToGroupLink.ps1.
|
||||
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Windows Defender Credential Guard protection limits (Windows 10)
|
||||
description: Scenarios not protected by Windows Defender Credential Guard in Windows 10.
|
||||
title: Windows Defender Credential Guard protection limits & mitigations (Windows 10)
|
||||
description: Scenarios not protected by Windows Defender Credential Guard in Windows 10, and additional mitigations you can use.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: explore
|
||||
ms.sitesec: library
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Prepare & Deploy Windows AD FS (Windows Hello for Business)
|
||||
title: Prepare & Deploy Windows AD FS certificate trust (Windows Hello for Business)
|
||||
description: How to Prepare and Deploy Windows Server 2016 Active Directory Federation Services (AD FS) for Windows Hello for Business
|
||||
keywords: identity, PIN, biometric, Hello, passport
|
||||
ms.prod: w10
|
||||
@ -54,6 +54,7 @@ Windows Hello for Business on-premises deployments require a federation server f
|
||||
The AD FS role needs a server authentication certificate for the federation services, but you can use a certificate issued by your enterprise (internal) certificate authority. The server authentication certificate should have the following names included in the certificate if you are requesting an individual certificate for each node in the federation farm:
|
||||
* Subject Name: The internal FQDN of the federation server (the name of the computer running AD FS)
|
||||
* Subject Alternate Name: Your federation service name, such as *fs.corp.contoso.com* (or an appropriate wildcard entry such as *.corp.contoso.com)
|
||||
* Subject Alternate Name: Your device registration service name, such as *enterpriseregistration.contoso.com*
|
||||
|
||||
You configure your federation service name when you configure the AD FS role. You can choose any name, but that name must be different than the name of the server or host. For example, you can name the host server **adfs** and the federation service **fs**. The FQDN of the host is adfs.corp.contoso.com and the FQDN of the federation service is fs.corp.contoso.com.
|
||||
|
||||
@ -193,6 +194,9 @@ Sign-in the federation server with _domain administrator_ equivalent credentials
|
||||
|
||||
### Add the AD FS Service account to the KeyCredential Admin group and the Windows Hello for Business Users group
|
||||
|
||||
> [!NOTE]
|
||||
> If you have a Windows Server 2016 domain controller in your domain, you can use the **Key Admins** group instead of **KeyCredential Administrators** and skip the **Configure Permissions for Key Registration** step.
|
||||
|
||||
The **KeyCredential Administrators** global group provides the AD FS service with the permissions needed to perform key registration. The Windows Hello for Business group provides the AD FS service with the permissions needed to enroll a Windows Hello for Business authentication certificate on behalf of the provisioning user.
|
||||
|
||||
Sign-in a domain controller or management workstation with _Domain Admin_ equivalent credentials.
|
||||
@ -363,9 +367,12 @@ Active Directory Federation Server used for Windows Hello for Business certifica
|
||||
Approximately 60 days prior to enrollment agent certificate’s expiration, the AD FS service attempts to renew the certificate until it is successful. If the certificate fails to renew, and the certificate expires, the AD FS server will request a new enrollment agent certificate. You can view the AD FS event logs to determine the status of the enrollment agent certificate.
|
||||
|
||||
### Service Connection Point (SCP) in Active Directory for ADFS Device Registration Service
|
||||
> [!NOTE]
|
||||
> Normally this script is not needed, as enabling Device Registration via the ADFS Management console already creates the objects. You can validate the SCP using the script below. For detailed information about the Device Registration Service, see [Configuring Device Registration](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn614658(v=ws.11)?redirectedfrom=MSDN)
|
||||
|
||||
Now you will add the Service connection Point to ADFS device registration Service for your Active directory by running the following script:
|
||||
|
||||
>[!TIP]
|
||||
> [!TIP]
|
||||
> Make sure to change the $enrollmentService and $configNC variables before running the script.
|
||||
|
||||
```Powershell
|
||||
@ -483,7 +490,7 @@ Before you continue with the deployment, validate your deployment progress by re
|
||||
* Confirm you properly configured the Windows Hello for Business authentication certificate template—to include:
|
||||
* Issuance requirements of an authorized signature from a certificate request agent.
|
||||
* The certificate template was properly marked as a Windows Hello for Business certificate template using certutil.exe
|
||||
* The Windows Hello for Business Users group, or equivalent has the allow enroll and allow auto enroll permissions
|
||||
* The Windows Hello for Business Users group, or equivalent has the allow enroll permissions
|
||||
* Confirm all certificate templates were properly published to the appropriate issuing certificate authorities.
|
||||
* Confirm the AD FS service account has the allow enroll permission for the Windows Hello Business authentication certificate template.
|
||||
* Confirm the AD FS certificate registration authority is properly configured using the `Get-AdfsCertificateAuthority` Windows PowerShell cmdlet.
|
||||
@ -496,6 +503,11 @@ Before you continue with the deployment, validate your deployment progress by re
|
||||
|
||||
You need to verify the AD FS service has properly enrolled for an enrollment agent certificate template. You can verify this is a variety ways, depending on if your service account is a normal user account or if the service account is a group managed service account.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> After following the previous steps, if you are unable to validate that the devices are, in fact, being registered automatically, there is a Group Policy at:
|
||||
> **Computer Configuration > Policies > Administrative Templates > Windows Components > Device Registration >** "Register Domain Joined Computers As Devices". Set the policy to **Enabled**
|
||||
> and the registration will happen automatically.
|
||||
|
||||
### Event Logs
|
||||
|
||||
Use the event logs on the AD FS service to confirm the service account enrolled for an enrollment agent certificate. First, look for the AD FS event ID 443 that confirms certificate enrollment cycle has finished. Once confirmed the AD FS certificate enrollment cycle completed review the CertificateLifecycle-User event log. In this event log, look for event ID 1006, which indicates a new certificate was installed. Details of the event log should show
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Configure Windows Hello for Business Policy settings (Windows Hello for Business)
|
||||
title: Configure Windows Hello for Business Policy settings - certificate trust
|
||||
description: Configure Windows Hello for Business Policy settings for Windows Hello for Business
|
||||
keywords: identity, PIN, biometric, Hello, passport
|
||||
ms.prod: w10
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Validate Active Directory prerequisites (Windows Hello for Business)
|
||||
description: How to Validate Active Directory prerequisites for Windows Hello for Business
|
||||
title: Update Active Directory schema for cert-trust deployment (Windows Hello for Business)
|
||||
description: How to Validate Active Directory prerequisites for Windows Hello for Business when deploying with the certificate trust model.
|
||||
keywords: identity, PIN, biometric, Hello, passport
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
@ -24,7 +24,7 @@ ms.reviewer:
|
||||
- Certificate trust
|
||||
|
||||
|
||||
The key registration process for the On-premises deployment of Windows Hello for Business needs the Windows Server 2016 Active Directory schema. The key-trust model receives the schema extension when the first Windows Server 2016 domain controller is added to the forest. The certificate trust model requires manually updating the current schema to the Windows Server 2016 schema. If you already have a Windows Server 2016 domain controller in your forest, you can skip the next step.
|
||||
The key registration process for the On-premises deployment of Windows Hello for Business needs the Windows Server 2016 Active Directory schema. The key-trust model receives the schema extension when the first Windows Server 2016 domain controller is added to the forest. The certificate trust model requires manually updating the current schema to the Windows Server 2016 schema. If you already have a Windows Server 2016 domain controller in your forest, you can skip the **Updating the Schema** and **Create the KeyCredential Admins Security Global Group** steps.
|
||||
|
||||
Manually updating Active Directory uses the command-line utility **adprep.exe** located at **\<drive>:\support\adprep** on the Windows Server 2016 DVD or ISO. Before running adprep.exe, you must identify the domain controller hosting the schema master role.
|
||||
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Validate and Deploy MFA for Windows Hello for Business
|
||||
title: Validate and Deploy MFA for Windows Hello for Business with certificate trust
|
||||
description: How to Validate and Deploy Multifactor Authentication (MFA) Services for Windows Hello for Business
|
||||
keywords: identity, PIN, biometric, Hello, passport
|
||||
ms.prod: w10
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Validate Public Key Infrastructure (Windows Hello for Business)
|
||||
title: Validate Public Key Infrastructure - certificate trust model (Windows Hello for Business)
|
||||
description: How to Validate Public Key Infrastructure for Windows Hello for Business
|
||||
keywords: identity, PIN, biometric, Hello, passport
|
||||
ms.prod: w10
|
||||
|
||||
@ -41,196 +41,64 @@ When a user encounters an error when creating the work PIN, advise the user to t
|
||||
5. On mobile devices, if you are unable to setup a PIN after multiple attempts, reset your device and start over. For help on how to reset your phone go to [Reset my phone](https://go.microsoft.com/fwlink/p/?LinkId=715697).
|
||||
If the error occurs again, check the error code against the following table to see if there is another mitigation for that error. When no mitigation is listed in the table, contact Microsoft Support for assistance.
|
||||
|
||||
<table>
|
||||
| Hex | Cause | Mitigation |
|
||||
| :--------- | :----------------------------------------------------------------- | :------------------------------------------ |
|
||||
| 0x80090005 | NTE\_BAD\_DATA | Unjoin the device from Azure AD and rejoin. |
|
||||
| 0x8009000F | The container or key already exists. | Unjoin the device from Azure AD and rejoin. |
|
||||
| 0x80090011 | The container or key was not found. | Unjoin the device from Azure AD and rejoin. |
|
||||
| 0x80090029 | TPM is not set up. | Sign on with an administrator account. Click **Start**, type "tpm.msc", and select **tpm.msc Microsoft Common Console Document**. In the **Actions** pane, select **Prepare the TPM**. |
|
||||
| 0x8009002A | NTE\_NO\_MEMORY | Close programs which are taking up memory and try again. |
|
||||
| 0x80090031 | NTE\_AUTHENTICATION\_IGNORED | Reboot the device. If the error occurs again after rebooting, [reset the TPM](https://go.microsoft.com/fwlink/p/?LinkId=619969) or run [Clear-TPM](https://go.microsoft.com/fwlink/p/?LinkId=629650). |
|
||||
| 0x80090035 | Policy requires TPM and the device does not have TPM. | Change the Windows Hello for Business policy to not require a TPM. |
|
||||
| 0x80090036 | User canceled an interactive dialog. | User will be asked to try again. |
|
||||
| 0x801C0003 | User is not authorized to enroll. | Check if the user has permission to perform the operation. |
|
||||
| 0x801C000E | Registration quota reached. | Unjoin some other device that is currently joined using the same account or [increase the maximum number of devices per user](https://go.microsoft.com/fwlink/p/?LinkId=626933). |
|
||||
| 0x801C000F | Operation successful, but the device requires a reboot. | Reboot the device. |
|
||||
| 0x801C0010 | The AIK certificate is not valid or trusted. | Sign out and then sign in again. |
|
||||
| 0x801C0011 | The attestation statement of the transport key is invalid. | Sign out and then sign in again. |
|
||||
| 0x801C0012 | Discovery request is not in a valid format. | Sign out and then sign in again. |
|
||||
| 0x801C0015 | The device is required to be joined to an Active Directory domain. | Join the device to an Active Directory domain. |
|
||||
| 0x801C0016 | The federation provider configuration is empty | Go to http://clientconfig.microsoftonline-p.net/FPURL.xml and verify that the file is not empty. |
|
||||
| 0x801C0017 | The federation provider domain is empty | Go to http://clientconfig.microsoftonline-p.net/FPURL.xml and verify that the FPDOMAINNAME element is not empty. |
|
||||
| 0x801C0018 | The federation provider client configuration URL is empty | Go to http://clientconfig.microsoftonline-p.net/FPURL.xml and verify that the CLIENTCONFIG element contains a valid URL. |
|
||||
| 0x801C03E9 | Server response message is invalid | Sign out and then sign in again. |
|
||||
| 0x801C03EA | Server failed to authorize user or device. | Check if the token is valid and user has permission to register Windows Hello for Business keys. |
|
||||
| 0x801C03EB | Server response http status is not valid | Sign out and then sign in again. |
|
||||
| 0x801C03EC | Unhandled exception from server. | sign out and then sign in again. |
|
||||
| 0x801C03ED | Multi-factor authentication is required for a 'ProvisionKey' operation, but was not performed. <br><br> -or- <br><br> Token was not found in the Authorization header. <br><br> -or- <br><br> Failed to read one or more objects. <br><br> -or- <br><br> The request sent to the server was invalid. | Sign out and then sign in again. If that doesn't resolve the issue, unjoin the device from Azure Active Directory (Azure AD) and rejoin.
|
||||
| 0x801C03EE | Attestation failed. | Sign out and then sign in again. |
|
||||
| 0x801C03EF | The AIK certificate is no longer valid. | Sign out and then sign in again. |
|
||||
| 0x801C03F2 | Windows Hello key registration failed. | ERROR\_BAD\_DIRECTORY\_REQUEST. Another object with the same value for property proxyAddresses already exists. To resolve the issue refer to [Duplicate Attributes Prevent Dirsync](https://docs.microsoft.com/office365/troubleshoot/administration/duplicate-attributes-prevent-dirsync).
|
||||
| 0x801C044D | Authorization token does not contain device ID. | Unjoin the device from Azure AD and rejoin. |
|
||||
| | Unable to obtain user token. | Sign out and then sign in again. Check network and credentials. |
|
||||
| 0x801C044E | Failed to receive user credentials input. | Sign out and then sign in again. |
|
||||
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th align="left">Hex</th>
|
||||
<th align="left">Cause</th>
|
||||
<th align="left">Mitigation</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
|
||||
<tr class="even">
|
||||
<td align="left">0x801C044D</td>
|
||||
<td align="left">Authorization token does not contain device ID</td>
|
||||
<td align="left">Unjoin the device from Azure AD and rejoin</td>
|
||||
</tr>
|
||||
|
||||
<tr class="odd">
|
||||
<td align="left">0x80090036</td>
|
||||
<td align="left">User canceled an interactive dialog</td>
|
||||
<td align="left">User will be asked to try again</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left">0x80090011</td>
|
||||
<td align="left">The container or key was not found</td>
|
||||
<td align="left">Unjoin the device from Azure AD and rejoin</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left">0x8009000F</td>
|
||||
<td align="left">The container or key already exists</td>
|
||||
<td align="left">Unjoin the device from Azure AD and rejoin</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left">0x8009002A</td>
|
||||
<td align="left">NTE_NO_MEMORY</td>
|
||||
<td align="left">Close programs which are taking up memory and try again.</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left">0x80090005</td>
|
||||
<td align="left">NTE_BAD_DATA</td>
|
||||
<td align="left">Unjoin the device from Azure AD and rejoin</td>
|
||||
</tr><tr class="even">
|
||||
<td align="left">0x80090029</td>
|
||||
<td align="left">TPM is not set up.</td>
|
||||
<td align="left">Sign on with an administrator account. Click <strong>Start</strong>, type "tpm.msc", and select <strong>tpm.msc Microsoft Common Console Document</strong>. In the <strong>Actions</strong> pane, select <strong>Prepare the TPM</strong>. </td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left">0x80090031</td>
|
||||
<td align="left">NTE_AUTHENTICATION_IGNORED</td>
|
||||
<td align="left">Reboot the device. If the error occurs again after rebooting, <a href="https://go.microsoft.com/fwlink/p/?LinkId=619969" data-raw-source="[reset the TPM]( https://go.microsoft.com/fwlink/p/?LinkId=619969)">reset the TPM</a> or run <a href="https://go.microsoft.com/fwlink/p/?LinkId=629650" data-raw-source="[Clear-TPM](https://go.microsoft.com/fwlink/p/?LinkId=629650)">Clear-TPM</a></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left">0x80090035</td>
|
||||
<td align="left">Policy requires TPM and the device does not have TPM.</td>
|
||||
<td align="left">Change the Windows Hello for Business policy to not require a TPM.</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left">0x801C0003</td>
|
||||
<td align="left">User is not authorized to enroll</td>
|
||||
<td align="left">Check if the user has permission to perform the operation.</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left">0x801C000E</td>
|
||||
<td align="left">Registration quota reached</td>
|
||||
<td align="left"><p>Unjoin some other device that is currently joined using the same account or <a href="https://go.microsoft.com/fwlink/p/?LinkId=626933" data-raw-source="[increase the maximum number of devices per user](https://go.microsoft.com/fwlink/p/?LinkId=626933)">increase the maximum number of devices per user</a>.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left">0x801C000F</td>
|
||||
<td align="left">Operation successful but the device requires a reboot</td>
|
||||
<td align="left">Reboot the device.</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left">0x801C0010</td>
|
||||
<td align="left">The AIK certificate is not valid or trusted</td>
|
||||
<td align="left">Sign out and then sign in again.</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left">0x801C0011</td>
|
||||
<td align="left">The attestation statement of the transport key is invalid</td>
|
||||
<td align="left">Sign out and then sign in again.</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left">0x801C0012</td>
|
||||
<td align="left">Discovery request is not in a valid format</td>
|
||||
<td align="left">Sign out and then sign in again.</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left">0x801C0015</td>
|
||||
<td align="left">The device is required to be joined to an Active Directory domain</td>
|
||||
<td align="left">Join the device to an Active Directory domain.</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left">0x801C0016</td>
|
||||
<td align="left">The federation provider configuration is empty</td>
|
||||
<td align="left">Go to <a href="http://clientconfig.microsoftonline-p.net/FPURL.xml" data-raw-source="[http://clientconfig.microsoftonline-p.net/FPURL.xml](http://clientconfig.microsoftonline-p.net/FPURL.xml)">http://clientconfig.microsoftonline-p.net/FPURL.xml</a> and verify that the file is not empty.</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left">0x801C0017</td>
|
||||
<td align="left">The federation provider domain is empty</td>
|
||||
<td align="left">Go to <a href="http://clientconfig.microsoftonline-p.net/FPURL.xml" data-raw-source="[http://clientconfig.microsoftonline-p.net/FPURL.xml](http://clientconfig.microsoftonline-p.net/FPURL.xml)">http://clientconfig.microsoftonline-p.net/FPURL.xml</a> and verify that the FPDOMAINNAME element is not empty.</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left">0x801C0018</td>
|
||||
<td align="left">The federation provider client configuration URL is empty</td>
|
||||
<td align="left">Go to <a href="http://clientconfig.microsoftonline-p.net/FPURL.xml" data-raw-source="[http://clientconfig.microsoftonline-p.net/FPURL.xml](http://clientconfig.microsoftonline-p.net/FPURL.xml)">http://clientconfig.microsoftonline-p.net/FPURL.xml</a> and verify that the CLIENTCONFIG element contains a valid URL.</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left">0x801C03E9</td>
|
||||
<td align="left">Server response message is invalid</td>
|
||||
<td align="left">Sign out and then sign in again.</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left">0x801C03EA</td>
|
||||
<td align="left">Server failed to authorize user or device.</td>
|
||||
<td align="left">Check if the token is valid and user has permission to register Windows Hello for Business keys.</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left">0x801C03EB</td>
|
||||
<td align="left">Server response http status is not valid</td>
|
||||
<td align="left">Sign out and then sign in again.</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left">0x801C03EC</td>
|
||||
<td align="left">Unhandled exception from server.</td>
|
||||
<td align="left">sign out and then sign in again.</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left">0x801C03ED</td>
|
||||
<td align="left"><p>Multi-factor authentication is required for a 'ProvisionKey' operation, but was not performed</p>
|
||||
<p>-or-</p>
|
||||
<p>Token was not found in the Authorization header</p>
|
||||
<p>-or-</p>
|
||||
<p>Failed to read one or more objects</p>
|
||||
<p>-or-</p><p>The request sent to the server was invalid.</p></td>
|
||||
<td align="left">Sign out and then sign in again. If that doesn't resolve the issue, unjoin the device from Azure Active Directory (Azure AD) and rejoin.</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left">0x801C03EE</td>
|
||||
<td align="left">Attestation failed</td>
|
||||
<td align="left">Sign out and then sign in again.</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left">0x801C03EF</td>
|
||||
<td align="left">The AIK certificate is no longer valid</td>
|
||||
<td align="left">Sign out and then sign in again.</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left">0x801C03F2</td>
|
||||
<td align="left">Windows Hello key registration failed.</td>
|
||||
<td align="left">ERROR_BAD_DIRECTORY_REQUEST. Another object with the same value for property proxyAddresses already exists. To resolve the issue refer to <a href="https://docs.microsoft.com/office365/troubleshoot/administration/duplicate-attributes-prevent-dirsync" data-raw-source="[Duplicate Attributes Prevent Dirsync]( https://docs.microsoft.com/office365/troubleshoot/administration/duplicate-attributes-prevent-dirsync)">Duplicate Attributes Prevent Dirsync</a>. </td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left">0x801C044D</td>
|
||||
<td align="left">Unable to obtain user token</td>
|
||||
<td align="left">Sign out and then sign in again. Check network and credentials.</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left">0x801C044E</td>
|
||||
<td align="left">Failed to receive user creds input</td>
|
||||
<td align="left">Sign out and then sign in again.</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
## Errors with unknown mitigation
|
||||
|
||||
For errors listed in this table, contact Microsoft Support for assistance.
|
||||
|
||||
| Hex | Cause |
|
||||
| Hex | Cause |
|
||||
|-------------|---------|
|
||||
| 0x80072f0c | Unknown |
|
||||
| 0x80070057 | Invalid parameter or argument is passed |
|
||||
| 0x80090027 | Caller provided wrong parameter. If third-party code receives this error they must change their code. |
|
||||
| 0x8009002D | NTE\_INTERNAL\_ERROR |
|
||||
| 0x80090020 | NTE\_FAIL |
|
||||
| 0x801C0001 | ADRS server response is not in valid format |
|
||||
| 0x801C0002 | Server failed to authenticate the user |
|
||||
| 0x801C0006 | Unhandled exception from server |
|
||||
| 0x801C000C | Discovery failed |
|
||||
| 0x801C001B | The device certificate is not found |
|
||||
| 0x801C000B | Redirection is needed and redirected location is not a well known server |
|
||||
| 0X80072F0C | Unknown |
|
||||
| 0x80070057 | Invalid parameter or argument is passed. |
|
||||
| 0x80090020 | NTE\_FAIL |
|
||||
| 0x80090027 | Caller provided a wrong parameter. If third-party code receives this error, they must change their code. |
|
||||
| 0x8009002D | NTE\_INTERNAL\_ERROR |
|
||||
| 0x801C0001 | ADRS server response is not in a valid format. |
|
||||
| 0x801C0002 | Server failed to authenticate the user. |
|
||||
| 0x801C0006 | Unhandled exception from server. |
|
||||
| 0x801C000B | Redirection is needed and redirected location is not a well known server. |
|
||||
| 0x801C000C | Discovery failed. |
|
||||
| 0x801C0013 | Tenant ID is not found in the token. |
|
||||
| 0x801C0014 | User SID is not found in the token. |
|
||||
| 0x801C0019 | The federation provider client configuration is empty |
|
||||
| 0x801C001A | The DRS endpoint in the federation provider client configuration is empty |
|
||||
| 0x801C0013 | Tenant ID is not found in the token |
|
||||
| 0x801C0014 | User SID is not found in the token |
|
||||
| 0x801C03F1 | There is no UPN in the token |
|
||||
| 0x801C03F0 | There is no key registered for the user |
|
||||
| 0x801C03F1 | There is no UPN in the token |
|
||||
| 0x801C044C | There is no core window for the current thread |
|
||||
|
||||
| 0x801C001A | The DRS endpoint in the federation provider client configuration is empty. |
|
||||
| 0x801C001B | The device certificate is not found. |
|
||||
| 0x801C03F0 | There is no key registered for the user. |
|
||||
| 0x801C03F1 | There is no UPN in the token. |
|
||||
| 0x801C044C | There is no core window for the current thread. |
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
|
||||
@ -51,7 +51,7 @@ In this task you will
|
||||
|
||||
The designed Windows for Business configuration has you give the **Key Admins** (or **KeyCredential Admins** when using domain controllers prior to Windows Server 2016) group read and write permissions to the msDS-KeyCredentialsLink attribute. You provided these permissions at root of the domain and use object inheritance to ensure the permissions apply to all users in the domain regardless of their location within the domain hierarchy.
|
||||
|
||||
Active Directory Domain Services uses AdminSDHolder to secure privileged users and groups from unintentional modification by comparing and replacing the security on privileged users and groups to match those defined on the AdminSDHolder object on an hourly cycle. For Windows Hello for Business, your domain administrator account may receive the permissions but will they will disappear from the user object unless you give the AdminSDHolder read and write permissions to the msDS-KeyCredential attribute.
|
||||
Active Directory Domain Services uses AdminSDHolder to secure privileged users and groups from unintentional modification by comparing and replacing the security on privileged users and groups to match those defined on the AdminSDHolder object on an hourly cycle. For Windows Hello for Business, your domain administrator account may receive the permissions but they will disappear from the user object unless you give the AdminSDHolder read and write permissions to the msDS-KeyCredential attribute.
|
||||
|
||||
Sign-in to a domain controller or management workstation with access equivalent to _domain administrator_.
|
||||
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Conditional Access
|
||||
title: Dynamic lock
|
||||
description: Conditional Access
|
||||
keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, cert-trust, device, registration, unlock, conditional access
|
||||
ms.prod: w10
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Azure AD Join Single Sign-on Deployment Guides
|
||||
title: Azure AD Join Single Sign-on Deployment
|
||||
description: Azure Active Directory joined devices in a hybrid Deployment for on-premises single sign-on
|
||||
keywords: identity, PIN, biometric, Hello, passport, AADJ, SSO,
|
||||
ms.prod: w10
|
||||
@ -16,7 +16,7 @@ localizationpriority: medium
|
||||
ms.date: 08/19/2018
|
||||
ms.reviewer:
|
||||
---
|
||||
# Azure AD Join Single Sign-on Deployment Guides
|
||||
# Azure AD Join Single Sign-on Deployment
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Configuring Hybrid Windows Hello for Business - Active Directory (AD)
|
||||
title: Configure Hybrid Windows Hello for Business - Active Directory (AD)
|
||||
description: Discussing the configuration of Active Directory (AD) in a Hybrid deployment of Windows Hello for Business
|
||||
keywords: identity, PIN, biometric, Hello, passport, WHFB, ad
|
||||
ms.prod: w10
|
||||
@ -16,7 +16,7 @@ localizationpriority: medium
|
||||
ms.date: 08/19/2018
|
||||
ms.reviewer:
|
||||
---
|
||||
# Configuring Windows Hello for Business: Active Directory
|
||||
# Configure Windows Hello for Business: Active Directory
|
||||
|
||||
**Applies to**
|
||||
- Windows 10, version 1703 or later
|
||||
|
||||
@ -51,13 +51,16 @@ Sign-in the AD FS server with *Domain Admin* equivalent credentials.
|
||||
|
||||
The Windows Hello for Business group provides the AD FS service with the permissions needed to enroll a Windows Hello for Business authentication certificate on behalf of the provisioning user.
|
||||
|
||||
> [!TIP]
|
||||
> The adfssvc account is the AD FS service account.
|
||||
|
||||
Sign-in a domain controller or management workstation with _Domain Admin_ equivalent credentials.
|
||||
|
||||
1. Open **Active Directory Users and Computers**.
|
||||
2. Click the **Users** container in the navigation pane.
|
||||
3. Right-click **Windows Hello for Business Users** group
|
||||
4. Click the **Members** tab and click **Add**
|
||||
5. In the **Enter the object names to select** text box, type **adfssvc**. Click **OK**.
|
||||
5. In the **Enter the object names to select** text box, type **adfssvc** or substitute the name of the AD FS service account in your AD FS deployment. Click **OK**.
|
||||
6. Click **OK** to return to **Active Directory Users and Computers**.
|
||||
7. Restart the AD FS server.
|
||||
|
||||
|
||||
@ -78,7 +78,8 @@ Sign-in a certificate authority or management workstations with _Enterprise Admi
|
||||
The certificate template is configured to supersede all the certificate templates provided in the certificate templates superseded templates list. However, the certificate template and the superseding of certificate templates is not active until you publish the certificate template to one or more certificate authorities.
|
||||
|
||||
> [!NOTE]
|
||||
> The Domain Controller Certificate must be present in the NTAuth store. By default, Microsoft Enterprise CAs are added to the NTAuth store. If you are using a 3rd party CA, this may not be done by default. If the Domain Controller Certificate is not present in the NTAuth store, user authentication will fail.
|
||||
> * The Domain Controller Certificate must be present in the NTAuth store. By default, Microsoft Enterprise CAs are added to the NTAuth store.
|
||||
> * If you are using a 3rd party CA, add the certificate to the NTAuth store. If the Domain Controller Certificate is not present in the NTAuth store, user authentication will fail.
|
||||
|
||||
### Enrollment Agent certificate template
|
||||
|
||||
|
||||
@ -47,9 +47,9 @@ Sign-in a domain controller or management workstation with _Domain Admin_ equiva
|
||||
> [!div class="checklist"]
|
||||
> * Configure group membership for Azure AD Connect
|
||||
|
||||
>[!div class="step-by-step"]
|
||||
[< Configure Active Directory](hello-hybrid-key-whfb-settings-ad.md)
|
||||
[Configure PKI >](hello-hybrid-key-whfb-settings-pki.md)
|
||||
> [!div class="step-by-step"]
|
||||
> [< Configure Active Directory](hello-hybrid-key-whfb-settings-ad.md)
|
||||
> [Configure PKI >](hello-hybrid-key-whfb-settings-pki.md)
|
||||
|
||||
<hr>
|
||||
|
||||
|
||||
@ -17,6 +17,7 @@ ms.topic: article
|
||||
localizationpriority: medium
|
||||
ms.date: 05/05/2018
|
||||
---
|
||||
|
||||
# Windows Hello for Business
|
||||
|
||||
In Windows 10, Windows Hello for Business replaces passwords with strong two-factor authentication on PCs and mobile devices. This authentication consists of a new type of user credential that is tied to a device and uses a biometric or PIN.</br>
|
||||
@ -29,13 +30,24 @@ Windows Hello addresses the following problems with passwords:
|
||||
- Passwords are subject to [replay attacks](https://go.microsoft.com/fwlink/p/?LinkId=615673).
|
||||
- Users can inadvertently expose their passwords due to [phishing attacks](https://docs.microsoft.com/windows/security/threat-protection/intelligence/phishing).
|
||||
|
||||
>[!div class="mx-tdBreakAll"]
|
||||
>| | | |
|
||||
>| :---: | :---: | :---: |
|
||||
>| [](hello-overview.md)</br>[Overview](hello-overview.md) | [](hello-why-pin-is-better-than-password.md)</br>[Why PIN is better than a password](hello-why-pin-is-better-than-password.md) | [](hello-manage-in-organization.md)</br>[Manage Windows Hello in your Organization](hello-manage-in-organization.md) |
|
||||
> | | | |
|
||||
> | :---: | :---: | :---: |
|
||||
> | [](hello-overview.md)</br>[Overview](hello-overview.md) | [](hello-why-pin-is-better-than-password.md)</br>[Why PIN is better than a password](hello-why-pin-is-better-than-password.md) | [](hello-manage-in-organization.md)</br>[Manage Windows Hello in your Organization](hello-manage-in-organization.md) |
|
||||
|
||||
## Prerequisites
|
||||
|
||||
> [!Important]
|
||||
> 1. Hybrid deployments support non-destructive PIN reset that only works with the certificate trust model.</br>.
|
||||
> **Requirements:**</br>
|
||||
> Microsoft PIN Reset Service - Windows 10, versions 1709 to 1809, Enterprise Edition. There is no licensing requirement for this service since version 1903</br>
|
||||
> Reset above lock screen (_I forgot my PIN_ link) - Windows 10, version 1903
|
||||
>
|
||||
> 2. On-premises deployments support destructive PIN reset that works with both the certificate trust and the key trust models.</br>
|
||||
> **Requirements:**</br>
|
||||
> Reset from settings - Windows 10, version 1703, Professional</br>
|
||||
> Reset above lock screen - Windows 10, version 1709, Professional</br>
|
||||
> Reset above lock screen (_I forgot my PIN_ link) - Windows 10, version 1903
|
||||
|
||||
### Cloud Only Deployment
|
||||
|
||||
* Windows 10, version 1511 or later
|
||||
@ -57,7 +69,7 @@ The table shows the minimum requirements for each deployment. For key trust in a
|
||||
| Windows Server 2016 or later Domain Controllers | Windows Server 2008 R2 or later Domain Controllers | Windows Server 2016 or later Domain Controllers | Windows Server 2008 R2 or later Domain Controllers |
|
||||
| Windows Server 2012 or later Certificate Authority | Windows Server 2012 or later Certificate Authority | Windows Server 2012 or later Certificate Authority | Windows Server 2012 or later Certificate Authority |
|
||||
| N/A | Windows Server 2016 AD FS with [KB4088889 update](https://support.microsoft.com/help/4088889) (hybrid Azure AD joined clients),<br> and</br>Windows Server 2012 or later Network Device Enrollment Service (Azure AD joined) | N/A | Windows Server 2012 or later Network Device Enrollment Service |
|
||||
| Azure MFA tenant, or</br>AD FS w/Azure MFA adapter, or</br>AD FS w/3rd Party MFA Adapter| Azure MFA tenant, or</br>AD FS w/Azure MFA adapter, or</br>AD FS w/3rd Party MFA Adapter | Azure MFA tenant, or</br>AD FS w/Azure MFA adapter, or</br>AD FS w/3rd Party MFA Adapter | Azure MFA tenant, or</br>AD FS w/Azure MFA adapter, or</br>AD FS w/3rd Party MFA Adapter |
|
||||
| Azure MFA tenant, or</br>AD FS w/Azure MFA adapter, or</br>AD FS w/Azure MFA Server adapter, or</br>AD FS w/3rd Party MFA Adapter | Azure MFA tenant, or</br>AD FS w/Azure MFA adapter, or</br>AD FS w/Azure MFA Server adapter, or</br>AD FS w/3rd Party MFA Adapter | Azure MFA tenant, or</br>AD FS w/Azure MFA adapter, or</br>AD FS w/Azure MFA Server adapter, or</br>AD FS w/3rd Party MFA Adapter | Azure MFA tenant, or</br>AD FS w/Azure MFA adapter, or</br>AD FS w/Azure MFA Server adapter, or</br>AD FS w/3rd Party MFA Adapter |
|
||||
| Azure Account | Azure Account | Azure Account | Azure Account |
|
||||
| Azure Active Directory | Azure Active Directory | Azure Active Directory | Azure Active Directory |
|
||||
| Azure AD Connect | Azure AD Connect | Azure AD Connect | Azure AD Connect |
|
||||
@ -78,5 +90,5 @@ The table shows the minimum requirements for each deployment.
|
||||
| AD FS with 3rd Party MFA Adapter | AD FS with 3rd Party MFA Adapter |
|
||||
| Azure Account, optional for Azure MFA billing | Azure Account, optional for Azure MFA billing |
|
||||
|
||||
>[!IMPORTANT]
|
||||
> [!IMPORTANT]
|
||||
> For Windows Hello for Business key trust deployments, if you have several domains, at least one Windows Server Domain Controller 2016 or newer is required for each domain. For more information, see the [planning guide](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers).
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Prepare & Deploy Windows Active Directory Federation Services
|
||||
title: Prepare & Deploy Windows Active Directory Federation Services with key trust (Windows Hello for Business)
|
||||
description: How to Prepare and Deploy Windows Server 2016 Active Directory Federation Services for Windows Hello for Business
|
||||
keywords: identity, PIN, biometric, Hello, passport
|
||||
ms.prod: w10
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Configure Windows Hello for Business Policy settings (Windows Hello for Business)
|
||||
title: Configure Windows Hello for Business Policy settings - key trust
|
||||
description: Configure Windows Hello for Business Policy settings for Windows Hello for Business
|
||||
keywords: identity, PIN, biometric, Hello, passport
|
||||
ms.prod: w10
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Validate Active Directory prerequisites (Windows Hello for Business)
|
||||
description: How to Validate Active Directory prerequisites for Windows Hello for Business
|
||||
title: Key registration for on-premises deployment of Windows Hello for Business
|
||||
description: How to Validate Active Directory prerequisites for Windows Hello for Business when deploying with the key trust model.
|
||||
keywords: identity, PIN, biometric, Hello, passport
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Validate and Deploy MFA for Windows Hello for Business
|
||||
title: Validate and Deploy MFA for Windows Hello for Business with key trust
|
||||
description: How to Validate and Deploy Multifactor Authentication (MFA) Services for Windows Hello for Business with key trust
|
||||
keywords: identity, PIN, biometric, Hello, passport
|
||||
ms.prod: w10
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Validate Public Key Infrastructure (Windows Hello for Business)
|
||||
title: Validate Public Key Infrastructure - key trust model (Windows Hello for Business)
|
||||
description: How to Validate Public Key Infrastructure for Windows Hello for Business
|
||||
keywords: identity, PIN, biometric, Hello, passport
|
||||
ms.prod: w10
|
||||
@ -16,6 +16,7 @@ localizationpriority: medium
|
||||
ms.date: 08/19/2018
|
||||
ms.reviewer:
|
||||
---
|
||||
|
||||
# Validate and Configure Public Key Infrastructure
|
||||
|
||||
**Applies to**
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Windows Hello for Business (Windows 10)
|
||||
ms.reviewer:
|
||||
title: Windows Hello for Business Overview (Windows 10)
|
||||
ms.reviewer: An overview of Windows Hello for Business
|
||||
description: An overview of Windows Hello for Business
|
||||
keywords: identity, PIN, biometric, Hello, passport
|
||||
ms.prod: w10
|
||||
@ -15,6 +15,7 @@ ms.collection: M365-identity-device-management
|
||||
ms.topic: conceptual
|
||||
localizationpriority: medium
|
||||
---
|
||||
|
||||
# Windows Hello for Business Overview
|
||||
|
||||
**Applies to**
|
||||
|
||||
@ -64,11 +64,23 @@ The hybrid deployment model is for organizations that:
|
||||
* Have identities synchronized to Azure Active Directory using Azure Active Directory Connect
|
||||
* Use applications hosted in Azure Active Directory, and want a single sign-in user experience for both on-premises and Azure Active Directory resources
|
||||
|
||||
> [!Important]
|
||||
> Hybrid deployments support non-destructive PIN reset that only works with the certificate trust model.</br>
|
||||
> **Requirements:**</br>
|
||||
> Microsoft PIN Reset Service - Windows 10, versions 1709 to 1809, Enterprise Edition. There is no licensing requirement for this service since version 1903</br>
|
||||
> Reset above lock screen (_I forgot my PIN_ link) - Windows 10, version 1903
|
||||
|
||||
##### On-premises
|
||||
The on-premises deployment model is for organizations that do not have cloud identities or use applications hosted in Azure Active Directory.
|
||||
|
||||
> [!Important]
|
||||
> On-premises deployments support destructive PIN reset that works with both the certificate trust and the key trust models.</br>
|
||||
> **Requirements:**</br>
|
||||
> Reset from settings - Windows 10, version 1703, Professional</br>
|
||||
> Reset above lock screen - Windows 10, version 1709, Professional</br>
|
||||
> Reset above lock screen (_I forgot my PIN_ link) - Windows 10, version 1903
|
||||
|
||||
It’s fundamentally important to understand which deployment model to use for a successful deployment. Some of aspects of the deployment may already be decided for you based on your current infrastructure.
|
||||
It’s fundamentally important to understand which deployment model to use for a successful deployment. Some aspects of the deployment may have already been decided for you based on your current infrastructure.
|
||||
|
||||
#### Trust types
|
||||
|
||||
|
||||
@ -97,14 +97,14 @@ The smart card reader device name is constructed in the form <*VendorName*>
|
||||
| 607 | Reader object failed to start monitor thread: %1 | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve the issue.<br>%1 = Windows error code |
|
||||
| 608 | Reader monitor failed to create power down timer: %1 | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve the issue.<br>%1 = Windows error code |
|
||||
| 609 | Reader monitor failed to create overlapped event: %1 | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve the issue.<br>%1 = Windows error code |
|
||||
| 610 | Smart Card Reader '%2' rejected IOCTL %3: %1 If this error persists, your smart card or reader may not be functioning correctly.%n%nCommand Header: %4 | The reader cannot successfully transmit the indicated IOCTL to the smart card. This is a benign error that does not affect end use of a smart card and can be ignored.<br>%1 = Windows error code<br>%2 = Name of the smart card reader<br>%3 = IOCTL that was sent<br>%4 = First 4 bytes of the command sent to the smart card |
|
||||
| 610 | Smart Card Reader '%2' rejected IOCTL %3: %1 If this error persists, your smart card or reader may not be functioning correctly.%n%nCommand Header: %4 | The reader cannot successfully transmit the indicated IOCTL to the smart card. This can indicate hardware failure, but this error can also occur if a smart card or smart card reader is removed from the system while an operation is in progress.<br>%1 = Windows error code<br>%2 = Name of the smart card reader<br>%3 = IOCTL that was sent<br>%4 = First 4 bytes of the command sent to the smart card <br> These events are caused by legacy functionality in the smart card stack. It can be ignored if there is no noticeable failure in the smart card usage scenarios.|
|
||||
| 611 | Smart Card Reader initialization failed | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve this issue. |
|
||||
| 612 | Reader insertion monitor error retry threshold reached: %1 | This occurs when a smart card reader fails several times to respond properly to the IOCTL, which indicates whether a smart card is present in the reader. The smart card reader is marked as defective, and it is not recognized by the service until it is removed from the computer and reinserted or until the computer is restarted.<br>%1 = Windows error code |
|
||||
| 615 | Reader removal monitor error retry threshold reached: %1 | This occurs when a smart card reader fails several times to respond properly to the IOCTL, which indicates whether a smart card is present in the reader. The smart card reader is marked as defective, and it is not recognized by the service until it is removed from the computer and reinserted or until the computer is restarted.<br>%1 = Windows error code |
|
||||
| 616 | Reader monitor '%2' received uncaught error code: %1 | This occurs when a smart card reader fails several times to respond properly to the IOCTL, which indicates whether a smart card is present in the reader. The smart card reader is marked as defective, and it is not recognized by the service until it is removed from the computer and reinserted or until the computer is restarted.<br>%1 = Windows error code<br>%2 = Reader name |
|
||||
| 617 | Reader monitor '%1' exception -- exiting thread | An unknown error occurred while monitoring a smart card reader for smart card insertions and removals. The smart card reader is marked as defective, and it is not recognized by the service until it is removed from the computer and reinserted or until the computer is restarted.<br>%1 = Smart card reader name |
|
||||
| 618 | Smart Card Resource Manager encountered an unrecoverable internal error. | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve the issue. |
|
||||
| 621 | Server Control failed to access start event: %1 | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve the issue. This error may also occur if the event is queried before the smart card service is ready. In this case the error is benign and can be ignored.<br>%1 = Windows error code |
|
||||
| 621 | Server Control failed to access start event: %1 | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve the issue.<br>%1 = Windows error code <br>These events are caused by legacy functionality in the smart card stack. It can be ignored if there is no noticeable failure in the smart card usage scenarios. |
|
||||
| 622 | Server Control failed to access stop event: %1 | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve the issue.<br>%1 = Windows error code |
|
||||
|
||||
## Smart card Plug and Play events
|
||||
|
||||
@ -37,7 +37,15 @@ If BitLocker is enabled on a drive before Group Policy has been applied to enfor
|
||||
|
||||
For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md).
|
||||
|
||||
The BitLocker Windows Management Instrumentation (WMI) interface does allow administrators to write a script to back up or synchronize an online client's existing recovery information; however, BitLocker does not automatically manage this process. The manage-bde command-line tool can also be used to manually back up recovery information to AD DS. For example, to back up all of the recovery information for the C: drive to AD DS, you would use the following command from an elevated command prompt: **manage-bde -protectors -adbackup C:**.
|
||||
The BitLocker Windows Management Instrumentation (WMI) interface does allow administrators to write a script to back up or synchronize an online client's existing recovery information; however, BitLocker does not automatically manage this process. The manage-bde command-line tool can also be used to manually back up recovery information to AD DS. For example, to back up all of the recovery information for the `$env:SystemDrive` to AD DS, you would use the following command script from an elevated command prompt:
|
||||
|
||||
```PowerShell
|
||||
$BitLocker = Get-BitLockerVolume -MountPoint $env:SystemDrive
|
||||
$RecoveryProtector = $BitLocker.KeyProtector | Where-Object { $_.KeyProtectorType -eq 'RecoveryPassword' }
|
||||
|
||||
Backup-BitLockerKeyProtector -MountPoint $env:SystemDrive -KeyProtectorId $RecoveryProtector.KeyProtectorID
|
||||
BackupToAAD-BitLockerKeyProtector -MountPoint $env:SystemDrive -KeyProtectorId $RecoveryProtector.KeyProtectorID
|
||||
```
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Joining a computer to the domain should be the first step for new computers within an organization. After computers are joined to a domain, storing the BitLocker recovery key to AD DS is automatic (when enabled in Group Policy).
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: BitLocker frequently asked questions (FAQ) (Windows 10)
|
||||
title: BitLocker deployment and administration FAQ (Windows 10)
|
||||
description: This topic for the IT professional answers frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker.
|
||||
ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee
|
||||
ms.reviewer:
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: BitLocker frequently asked questions (FAQ) (Windows 10)
|
||||
title: BitLocker FAQ (Windows 10)
|
||||
description: This topic for the IT professional answers frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker.
|
||||
ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee
|
||||
ms.reviewer:
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: BitLocker frequently asked questions (FAQ) (Windows 10)
|
||||
title: BitLocker Network Unlock FAQ (Windows 10)
|
||||
description: This topic for the IT professional answers frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: explore
|
||||
|
||||
@ -73,7 +73,7 @@ Systems running Windows 10 version 1803 that do support Kernel DMA Protection do
|
||||
|
||||
### Using Security Center
|
||||
|
||||
Beginning with Wndows 10 version 1809, you can use Security Center to check if Kernel DMA Protection is enabled. Click **Start** > **Settings** > **Update & Security** > **Windows Security** > **Open Windows Security** > **Device security** > **Core isolation details** > **Memory access protection**.
|
||||
Beginning with Windows 10 version 1809, you can use Security Center to check if Kernel DMA Protection is enabled. Click **Start** > **Settings** > **Update & Security** > **Windows Security** > **Open Windows Security** > **Device security** > **Core isolation details** > **Memory access protection**.
|
||||
|
||||
|
||||
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
x
Reference in New Issue
Block a user