diff --git a/store-for-business/whats-new-microsoft-store-business-education.md b/store-for-business/whats-new-microsoft-store-business-education.md
index 38af4a8e01..80d4cc6d6c 100644
--- a/store-for-business/whats-new-microsoft-store-business-education.md
+++ b/store-for-business/whats-new-microsoft-store-business-education.md
@@ -11,7 +11,7 @@ ms.date: 1/8/2018
 
 # What's new in Microsoft Store for Business and Education
 
-Microsoft Store for Business and Education regularly releases new and improved feaures.  
+Microsoft Store for Business and Education regularly releases new and improved features.  
 
 ## Latest updates for Store for Business and Education
 
diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md
index 2065aba9d1..54c9115a56 100644
--- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md
+++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md
@@ -1405,6 +1405,7 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
 <ul>
 <li>AccountPoliciesAccountLockoutPolicy/AccountLockoutDuration</li>
 <li>AccountPoliciesAccountLockoutPolicy/AccountLockoutThreshold</li>
+<li>Browser/AllowConfigurationUpdateForBooksLibrary</li>
 <li>Browser/AlwaysEnableBooksLibrary</li>
 <li>Browser/EnableExtendedBooksTelemetry</li>
 <li>Browser/UseSharedFolderForBooks</li>
diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md
index f109ef3f90..6d072bbb43 100644
--- a/windows/client-management/mdm/policy-configuration-service-provider.md
+++ b/windows/client-management/mdm/policy-configuration-service-provider.md
@@ -434,6 +434,9 @@ The following diagram shows the Policy configuration service provider in tree fo
   <dd>
     <a href="./policy-csp-browser.md#browser-allowbrowser" id="browser-allowbrowser">Browser/AllowBrowser</a>
   </dd>
+  <dd>
+    <a href="./policy-csp-browser.md#browser-allowconfigurationupdateforbookslibrary" id="browser-allowconfigurationupdateforbookslibrary">Browser/AllowConfigurationUpdateForBooksLibrary</a>
+  </dd>
   <dd>
     <a href="./policy-csp-browser.md#browser-allowcookies" id="browser-allowcookies">Browser/AllowCookies</a>
   </dd>
@@ -473,9 +476,9 @@ The following diagram shows the Policy configuration service provider in tree fo
   <dd>
     <a href="./policy-csp-browser.md#browser-allowsmartscreen" id="browser-allowsmartscreen">Browser/AllowSmartScreen</a>
   </dd>
-  <!--<dd>
+  <dd>
     <a href="./policy-csp-browser.md#browser-alwaysenablebookslibrary" id="browser-alwaysenablebookslibrary">Browser/AlwaysEnableBooksLibrary</a>
-  </dd>-->
+  </dd>
   <dd>
     <a href="./policy-csp-browser.md#browser-clearbrowsingdataonexit" id="browser-clearbrowsingdataonexit">Browser/ClearBrowsingDataOnExit</a>
   </dd>
diff --git a/windows/client-management/mdm/policy-csp-browser.md b/windows/client-management/mdm/policy-csp-browser.md
index 9ffaf7854f..da6abdd0ee 100644
--- a/windows/client-management/mdm/policy-csp-browser.md
+++ b/windows/client-management/mdm/policy-csp-browser.md
@@ -6,7 +6,7 @@ ms.topic: article
 ms.prod: w10
 ms.technology: windows
 author: nickbrower
-ms.date: 01/30/2018
+ms.date: 01/31/2018
 ---
 
 # Policy CSP - Browser
@@ -30,6 +30,9 @@ ms.date: 01/30/2018
   <dd>
     <a href="#browser-allowbrowser">Browser/AllowBrowser</a>
   </dd>
+  <dd>
+    <a href="#browser-allowconfigurationupdateforbookslibrary">Browser/AllowConfigurationUpdateForBooksLibrary</a>
+  </dd>
   <dd>
     <a href="#browser-allowcookies">Browser/AllowCookies</a>
   </dd>
@@ -317,6 +320,64 @@ The following list shows the supported values:
 
 <hr/>
 
+<!--Policy-->
+<a href="" id="browser-allowconfigurationupdateforbookslibrary"></a>**Browser/AllowConfigurationUpdateForBooksLibrary**  
+
+<!--SupportedSKUs-->
+<table>
+<tr>
+	<th>Home</th>
+	<th>Pro</th>
+	<th>Business</th>
+	<th>Enterprise</th>
+	<th>Education</th>
+	<th>Mobile</th>
+	<th>Mobile Enterprise</th>
+</tr>
+<tr>
+	<td><img src="images/crossmark.png" alt="cross mark" /></td>
+	<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
+	<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
+	<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
+	<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
+	<td><img src="images/crossmark.png" alt="cross mark" /></td>
+	<td><img src="images/crossmark.png" alt="cross mark" /></td>
+</tr>
+</table>
+
+<!--/SupportedSKUs-->
+<!--Scope-->
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+<hr/>
+
+<!--/Scope-->
+<!--Description-->
+This policy setting lets you decide whether Microsoft Edge can automatically update the configuration data for the Books Library.
+
+<!--/Description-->
+<!--SupportedValues-->
+The following list shows the supported values:
+
+-   0 - Disable. Microsoft Edge cannot retrieve a configuration
+-   1 - Enable (default). Microsoft Edge can retrieve a configuration for Books Library
+
+
+<!--/SupportedValues-->
+<!--Example-->
+
+<!--/Example-->
+<!--Validation-->
+
+<!--/Validation-->
+<!--/Policy-->
+
+<hr/>
+
 <!--Policy-->
 <a href="" id="browser-allowcookies"></a>**Browser/AllowCookies**  
 
@@ -2270,6 +2331,62 @@ The following list shows the supported values:
 <!--/SupportedValues-->
 <!--/Policy-->
 <hr/>
+<!--StartPolicy-->
+<a href="" id="browser-usesharedfolderforbooks"></a>**Browser/UseSharedFolderForBooks**  
+
+<!--StartSKU-->
+<table>
+<tr>
+	<th>Home</th>
+	<th>Pro</th>
+	<th>Business</th>
+	<th>Enterprise</th>
+	<th>Education</th>
+	<th>Mobile</th>
+	<th>Mobile Enterprise</th>
+</tr>
+<tr>
+	<td><img src="images/crossmark.png" alt="cross mark" /></td>
+	<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
+	<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
+	<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
+	<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
+	<td><img src="images/crossmark.png" alt="cross mark" /></td>
+	<td><img src="images/crossmark.png" alt="cross mark" /></td>
+</tr>
+</table>
+
+<!--EndSKU-->
+<!--StartScope-->
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+<hr/>
+
+<!--EndScope-->
+<!--StartDescription-->
+This setting specifies whether organizations should use a folder shared across users to store books from the Books Library.
+
+<!--EndDescription-->
+<!--SupportedValues-->
+The following list shows the supported values:
+
+-   0 - No shared folder.
+-   1 - Use a shared folder.
+
+
+<!--/SupportedValues-->
+<!--Example-->
+
+<!--/Example-->
+<!--Validation-->
+
+<!--/Validation-->
+<!--EndPolicy-->
+<hr/>
 
 Footnote:
 
diff --git a/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md b/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md
index 47b499d041..6b6afaec07 100644
--- a/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md
+++ b/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md
@@ -83,6 +83,9 @@ The following diagram shows the WindowsDefenderApplicationGuard configuration se
 <a href="" id="installwindowsdefenderapplicationguard"></a>**InstallWindowsDefenderApplicationGuard**  
 <p style="margin-left: 20px">Initiates remote installation of Application Guard feature. Supported operations are Get and Execute.</p>
 
+- Install - Will initiate feature install
+- Uninstall - Will initiate feature uninstall
+
 <a href="" id="audit"></a>**Audit**  
 <p style="margin-left: 20px">Interior node. Supported operation is Get</p>
 
diff --git a/windows/configuration/change-history-for-configure-windows-10.md b/windows/configuration/change-history-for-configure-windows-10.md
index ce324c8cf1..a12a531608 100644
--- a/windows/configuration/change-history-for-configure-windows-10.md
+++ b/windows/configuration/change-history-for-configure-windows-10.md
@@ -8,7 +8,7 @@ ms.sitesec: library
 ms.pagetype: security
 ms.localizationpriority: high
 author: jdeckerms
-ms.date: 01/26/2018
+ms.date: 01/31/2018
 ---
 
 # Change history for Configure Windows 10
@@ -26,6 +26,8 @@ New or changed topic | Description
 [Configure Windows 10 taskbar](configure-windows-10-taskbar.md) | Added section for removing default apps from the taskbar.
 [Manage Windows 10 connection endpoints](manage-windows-endpoints-version-1709.md) | New topic for Windows 10, version 1709 that explains the purpose for connections to Microsoft services and how to manage them.  
 [Configure Windows Spotlight on the lock screen](windows-spotlight.md) | Added section for resolution of custom lock screen images.
+[Set up a kiosk on Windows 10 Pro, Enterprise, or Education](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) | Added section for automatic sign-in after restart on unmanaged devices.
+
 
 ## November 2017
 
diff --git a/windows/configuration/images/auto-signin.png b/windows/configuration/images/auto-signin.png
new file mode 100644
index 0000000000..260376199e
Binary files /dev/null and b/windows/configuration/images/auto-signin.png differ
diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md
index 7e5d71562c..ea121c6820 100644
--- a/windows/configuration/lock-down-windows-10-to-specific-apps.md
+++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md
@@ -9,7 +9,7 @@ ms.sitesec: library
 ms.pagetype: edu, security
 author: jdeckerms
 ms.localizationpriority: high
-ms.date: 11/26/2018
+ms.date: 01/31/2018
 ms.author: jdecker
 ---
 
@@ -52,6 +52,7 @@ If you don't want to use a provisioning package, you can deploy the configuratio
 - The kiosk device must be running Windows 10 (S, Pro, Enterprise, or Education), version 1709
 
 
+
 ## Create XML file
 
 Let's start by looking at the basic structure of the XML file. 
diff --git a/windows/configuration/set-up-a-kiosk-for-windows-10-for-desktop-editions.md b/windows/configuration/set-up-a-kiosk-for-windows-10-for-desktop-editions.md
index fcbf41202b..0fe1c5b458 100644
--- a/windows/configuration/set-up-a-kiosk-for-windows-10-for-desktop-editions.md
+++ b/windows/configuration/set-up-a-kiosk-for-windows-10-for-desktop-editions.md
@@ -8,7 +8,7 @@ ms.mktglfcycl: manage
 ms.sitesec: library
 author: jdeckerms
 ms.localizationpriority: high
-ms.date: 10/16/2017
+ms.date: 01/31/2018
 ---
 
 # Set up a kiosk on Windows 10 Pro, Enterprise, or Education
@@ -37,9 +37,15 @@ To return the device to the regular shell, see [Sign out of assigned access](#si
 >[!NOTE]
 >A Universal Windows app is built on the Universal Windows Platform (UWP), which was first introduced in Windows 8 as the Windows Runtime. A Classic Windows application uses the Classic Windows Platform (CWP) (e.g., COM, Win32, WPF, WinForms, etc.) and is typically launched using an .EXE or .DLL file.
 
- 
+## Using a local device as a kiosk
 
+When your kiosk is a local device that is not managed by Active Directory or Azure Active Directory, there is a default setting that enables automatic sign-in after a restart. That means that when the device restarts, the last signed-in user will be signed in automatically. If the last signed-in user is the kiosk account, the kiosk app will be launched automatically after the device restarts.
 
+If you want the kiosk account signed in automatically and the kiosk app launched when the device restarts, there is nothing you need to do.
+
+If you do not want the kiosk account signed in automatically when the device restarts, you must change the default setting before you configure the device as a kiosk. Sign in with the account that you will assign as the kiosk account, go to **Settings** > **Accounts** > **Sign-in options**, and toggle the **Use my sign-in info to automatically finish setting up my device after an update or restart** setting to **Off**. After you change the setting, you can apply the kiosk configuration to the device.
+
+![Screenshot of automatic sign-in setting](images/auto-signin.png)
 
 <span id="wizard" />
 ## Set up a kiosk using Windows Configuration Designer
diff --git a/windows/deployment/TOC.md b/windows/deployment/TOC.md
index c5ccc885d1..d306bd8ea5 100644
--- a/windows/deployment/TOC.md
+++ b/windows/deployment/TOC.md
@@ -8,6 +8,7 @@
 ### [Configure VDA for Subscription Activation](vda-subscription-activation.md)
 ### [Deploy Windows 10 Enterprise licenses](deploy-enterprise-licenses.md)
 ## [Resolve Windows 10 upgrade errors](upgrade/resolve-windows-10-upgrade-errors.md)
+### [Submit Windows 10 upgrade errors](upgrade/submit-errors.md)
 
 ## [Deploy Windows 10](deploy.md)
 
diff --git a/windows/deployment/images/downlevel.PNG b/windows/deployment/images/downlevel.PNG
new file mode 100644
index 0000000000..dff0ebb02b
Binary files /dev/null and b/windows/deployment/images/downlevel.PNG differ
diff --git a/windows/deployment/images/feedback.PNG b/windows/deployment/images/feedback.PNG
new file mode 100644
index 0000000000..8ff7391e84
Binary files /dev/null and b/windows/deployment/images/feedback.PNG differ
diff --git a/windows/deployment/images/firstboot.PNG b/windows/deployment/images/firstboot.PNG
new file mode 100644
index 0000000000..dfb798c93c
Binary files /dev/null and b/windows/deployment/images/firstboot.PNG differ
diff --git a/windows/deployment/images/safeos.PNG b/windows/deployment/images/safeos.PNG
new file mode 100644
index 0000000000..88c31087a4
Binary files /dev/null and b/windows/deployment/images/safeos.PNG differ
diff --git a/windows/deployment/images/secondboot.PNG b/windows/deployment/images/secondboot.PNG
new file mode 100644
index 0000000000..670fdce7b0
Binary files /dev/null and b/windows/deployment/images/secondboot.PNG differ
diff --git a/windows/deployment/images/secondboot2.PNG b/windows/deployment/images/secondboot2.PNG
new file mode 100644
index 0000000000..0034737e90
Binary files /dev/null and b/windows/deployment/images/secondboot2.PNG differ
diff --git a/windows/deployment/images/secondboot3.PNG b/windows/deployment/images/secondboot3.PNG
new file mode 100644
index 0000000000..c63ef6939d
Binary files /dev/null and b/windows/deployment/images/secondboot3.PNG differ
diff --git a/windows/deployment/images/share.jpg b/windows/deployment/images/share.jpg
new file mode 100644
index 0000000000..e8365ad34c
Binary files /dev/null and b/windows/deployment/images/share.jpg differ
diff --git a/windows/deployment/update/device-health-get-started.md b/windows/deployment/update/device-health-get-started.md
index 9350288947..175f553534 100644
--- a/windows/deployment/update/device-health-get-started.md
+++ b/windows/deployment/update/device-health-get-started.md
@@ -24,7 +24,7 @@ Steps are provided in sections that follow the recommended setup process:
 Device Health has the following requirements: 
 1. Device Health is currently only compatible with Windows 10 and Windows Server 2016 devices. The solution is intended to be used with desktop devices (Windows 10 workstations and laptops). 
 2. The solution requires that at least the [enhanced level of diagnostic data](https://technet.microsoft.com/itpro/windows/manage/configure-windows-diagnostic-data-in-your-organization#basic-level) is enabled on all devices that are intended to be displayed in the solution. To learn more about Windows diagnostic data, see [Configure Windows diagnostic data in your organization](/windows/configuration/configure-windows-diagnostic-data-in-your-organization). 
-3. The diagnostic data of your organization’s Windows devices must be successfully transmitted to Microsoft. Microsoft has specified [endpoints for each of the diagnostic data services](https://technet.microsoft.com/itpro/windows/manage/configure-windows-diagnostic-data-in-your-organization#endpoints), which must be whitelisted by your organization so the data can be transmitted. The following table is taken from the article on diagnostic data endpoints and summarizes the use of each endpoint:
+3. The diagnostic data of your organization’s Windows devices must be successfully transmitted to Microsoft. Microsoft has specified [endpoints for each of the diagnostic data services](/windows/configuration//configure-windows-diagnostic-data-in-your-organization#endpoints), which must be whitelisted by your organization so the data can be transmitted. The following table is taken from the article on diagnostic data endpoints and summarizes the use of each endpoint:
 
 Service | Endpoint
 --- | ---
diff --git a/windows/deployment/update/update-compliance-get-started.md b/windows/deployment/update/update-compliance-get-started.md
index ead61e2d95..354ad86c3d 100644
--- a/windows/deployment/update/update-compliance-get-started.md
+++ b/windows/deployment/update/update-compliance-get-started.md
@@ -36,7 +36,7 @@ Update Compliance has the following requirements:
 
  4. To use Windows Defender Antivirus Assessment, devices must be protected by Windows Defender AV (and not a 3rd party AV program), and must have enabled [cloud-delivered protection](/windows/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus). See the [Troublehsoot Windows Defender Antivirus reporting](/windows/threat-protection/windows-defender-antivirus/troubleshoot-reporting.md) topic for help on ensuring the configuration is correct.
  
-     For endpoints running Windows 10, version 1607 or earlier, [Windows diagnostic data must also be set to **Enhanced**](https://docs.microsoft.com/en-us/windows/configuration/configure-windows-diagnostic-data-in-your-organization#enhanced-level), to be compatible with Windows Defender Antivirus. 
+     For endpoints running Windows 10, version 1607 or earlier, [Windows diagnostic data must also be set to **Enhanced**](https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization#enhanced-level), to be compatible with Windows Defender Antivirus. 
     
     See the [Windows Defender Antivirus in Windows 10](/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10) content library for more information on enabling, configuring, and validating Windows Defender AV.
 
diff --git a/windows/deployment/update/waas-configure-wufb.md b/windows/deployment/update/waas-configure-wufb.md
index f705f7b85f..b6260dbd6d 100644
--- a/windows/deployment/update/waas-configure-wufb.md
+++ b/windows/deployment/update/waas-configure-wufb.md
@@ -28,7 +28,7 @@ ms.date: 10/13/2017
 You can use Group Policy or your mobile device management (MDM) service to configure Windows Update for Business settings for your devices. The sections in this topic provide the Group Policy and MDM policies for Windows 10, version 1511 and above. The MDM policies use the OMA-URI setting from the [Policy CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962.aspx).  
 
 >[!IMPORTANT]
->For Windows Update for Business policies to be honored, the Diagnostic Data level of the device must be set to **1 (Basic)** or higher.  If it is set to **0 (Security)**, Windows Update for Business policies will have no effect. For instructions, see [Configure the operating system diagnostic data level](https://technet.microsoft.com/en-us/itpro/windows/manage/configure-windows-diagnostic-data-in-your-organization#configure-the-operating-system-diagnostic-data-level).
+>For Windows Update for Business policies to be honored, the Diagnostic Data level of the device must be set to **1 (Basic)** or higher.  If it is set to **0 (Security)**, Windows Update for Business policies will have no effect. For instructions, see [Configure the operating system diagnostic data level](https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization#diagnostic-data-levels).
 
 Some Windows Update for Business policies are not applicable or behave differently for devices running Windows 10 Mobile Enterprise. Specifically, policies pertaining to Feature Updates will not be applied to Windows 10 Mobile Enterprise. All Windows 10 Mobile updates are recognized as Quality Updates, and can only be deferred or paused using the Quality Update policy settings. Additional information is provided in this topic and in [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md).
 
diff --git a/windows/deployment/upgrade/resolve-windows-10-upgrade-errors.md b/windows/deployment/upgrade/resolve-windows-10-upgrade-errors.md
index 858ea4aed7..265cddd65e 100644
--- a/windows/deployment/upgrade/resolve-windows-10-upgrade-errors.md
+++ b/windows/deployment/upgrade/resolve-windows-10-upgrade-errors.md
@@ -16,17 +16,19 @@ ms.localizationpriority: high
 **Applies to**
 -   Windows 10
 
->**Important**: This topic contains technical instructions for IT administrators. If you are not an IT administrator, see [Get help with Windows 10 upgrade and installation errors](https://support.microsoft.com/en-us/help/10587/windows-10-get-help-with-upgrade-installation-errors) for more information.
+>**Important**: This topic contains technical instructions for IT administrators. If you are not an IT administrator, see the following topic: [Get help with Windows 10 upgrade and installation errors](https://support.microsoft.com/en-us/help/10587/windows-10-get-help-with-upgrade-installation-errors). You can also [Submit Windows 10 upgrade errors using Feedback Hub](submit-errors.md).
 
 ## In this topic
 
 This topic contains a brief introduction to Windows 10 installation processes, and provides resolution procedures that IT administrators can use to resolve issues with Windows 10 upgrade. The following sections and procedures are provided in this guide:
 
+- [Troubleshooting upgrade errors](#troubleshooting-upgrade-errors): General advice and techniques for troubleshooting Windows 10 upgrade errors.<br>
 - [The Windows 10 upgrade process](#the-windows-10-upgrade-process): An explanation of phases used during the upgrade process.<br>
 - [Quick fixes](#quick-fixes): Steps you can take to eliminate many Windows upgrade errors.<br>
 - [Upgrade error codes](#upgrade-error-codes): The components of an error code are explained.
     - [Result codes](#result-codes): Information about result codes.
     - [Extend codes](#extend-codes): Information about extend codes.
+- [Windows Error Reporting](#windows-error-reporting): How to use Event Viewer to review details about a Windows 10 upgrade.
 - [Log files](#log-files): A list and description of log files useful for troubleshooting.
     - [Log entry structure](#log-entry-structure): The format of a log entry is described.
     - [Analyze log files](#analyze-log-files): General procedures for log file analysis, and an example.
@@ -36,19 +38,62 @@ This topic contains a brief introduction to Windows 10 installation processes, a
     - [Other result codes](#other-result-codes): Additional causes and mitigation procedures are provided for some result codes.
     - [Other error codes](#other-error-codes): Additional causes and mitigation procedures are provided for some error codes.
 
+## Troubleshooting upgrade errors
+
+If a Windows 10 upgrade is not successful, it can be very helpful to understand *when* an error occurred in the upgrade process. 
+
+Briefly, the upgrade process consists of four phases: **Downlevel**, **SafeOS**, **First boot**, and **Second boot**. The computer will reboot once between each phase. 
+
+These phases are explained in greater detail [below](#the-windows-10-upgrade-process). First, let's summarize the actions performed during each phase because this affects the type of errors that can be encountered.
+
+1. **Downlevel phase**: Because this phase runs on the source OS, upgrade errors are not typically seen. If you do encounter an error, ensure the source OS is stable. Also ensure the Windows setup source and the destination drive are accessible. 
+
+2. **SafeOS phase**: Errors most commonly occur during this phase due to hardware issues, firmware issues, or non-microsoft disk encryption software.
+
+    Since the computer is booted into Windows PE during the SafeOS phase, a useful troubleshooting technique is to boot into [Windows PE](https://docs.microsoft.com/windows-hardware/manufacture/desktop/winpe-intro) using installation media. You can use the [media creation tool](https://www.microsoft.com/software-download/windows10) to create bootable media, or you can use tools such as the [Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit), and then boot your device from this media to test for hardware and firmware compatibility issues.
+
+    **Do not proceed with the Windows 10 installation after booting from this media**. This method can only be used to perform a clean install which will not migrate any of your apps and settings, and you will be required re-enter your Windows 10 license information.
+
+    If the computer does not successfully boot into Windows PE using the media that you created, this is likely due to a hardware or firmware issue. Check with your hardware manufacturer and apply any recommended BIOS and firmware updates. If you are still unable to boot to installation media after applying updates, disconnect or replace legacy hardware.
+
+    If the computer successfully boots into Windows PE, but you are not able to browse the system drive on the computer, it is possible that non-Microsoft disk encryption software is blocking your ability to perform a Windows 10 upgrade. Update or temporarily remove the disk encryption.
+
+3. **First boot phase**: Boot failures in this phase are relatively rare, and almost exclusively caused by device drivers.  Disconnect all peripheral devices except for the mouse, keyboard, and display. Obtain and install updated device drivers, then retry the upgrade.
+4. **Second boot phase**: In this phase, the system is running under the target OS with new drivers. Boot failures are most commonly due to anti-virus software or filter drivers. Disconnect all peripheral devices except for the mouse, keyboard, and display. Obtain and install updated device drivers, then retry the upgrade.
+ 
+If the general troubleshooting techniques described above or the [quick fixes](#quick-fixes) detailed below do not resolve your issue, you can attempt to analyze [log files](#log-files) and interpret [upgrade error codes](#upgrade-error-codes). You can also [Submit Windows 10 upgrade errors using Feedback Hub](submit-errors.md) so that Microsoft can diagnose your issue.
+
 ## The Windows 10 upgrade process
 
-The Windows Setup application is used to upgrade a computer to Windows 10, or to perform a clean installation. Windows Setup starts and restarts the computer, gathers information, copies files, and creates or adjusts configuration settings. When performing an operating system upgrade, Windows Setup uses the following phases:
+The **Windows Setup** application is used to upgrade a computer to Windows 10, or to perform a clean installation. Windows Setup starts and restarts the computer, gathers information, copies files, and creates or adjusts configuration settings. 
 
-1. **Downlevel phase**: The downlevel phase is run within the previous operating system. Installation components are gathered.
-2. **Safe OS phase**: A recovery partition is configured and updates are installed. An OS rollback is prepared if needed.
-        - Example error codes: 0x2000C, 0x20017
-3. **First boot phase**: Initial settings are applied.
-        - Example error codes: 0x30018, 0x3000D
-4. **Second boot phase**: Final settings are applied. This is also called the **OOBE boot phase**.
-        - Example error: 0x4000D, 0x40017
-5. **Uninstall phase**: This phase occurs if upgrade is unsuccessful.
-        - Example error: 0x50000
+When performing an operating system upgrade, Windows Setup uses the following phases. A reboot occurs between each of the phases.
+
+The user interface will be the same during the Safe OS phase, the first boot phase, and the beginning of the second boot phase. Percent progress is displayed and will advance as you move through each phase, reaching 100% at the end of the second boot phase.
+
+1. **Downlevel phase**: The downlevel phase is run within the previous operating system. Windows files are copied and installation components are gathered.
+
+    ![downlevel phase](../images/downlevel.png)  
+
+2. **Safe OS phase**: A recovery partition is configured, Windows files are expanded, and updates are installed. An OS rollback is prepared if needed. Example error codes: 0x2000C, 0x20017.
+
+    ![safeOS phase](../images/safeos.png) 
+
+3. **First boot phase**: Initial settings are applied. Example error codes: 0x30018, 0x3000D.
+
+    ![first boot phase](../images/firstboot.png) 
+
+4. **Second boot phase**: Final settings are applied. This is also called the **OOBE boot phase**. Example error codes: 0x4000D, 0x40017. 
+
+    At the end of the second boot phase, the **Welcome to Windows 10** screen is displayed, preferences are configured, and the Windows 10 sign-in prompt is displayed.
+
+    ![second boot phase](../images/secondboot.png) 
+
+    ![second boot phase](../images/secondboot2.png) 
+
+    ![second boot phase](../images/secondboot3.png) 
+
+5. **Uninstall phase**: This phase occurs if upgrade is unsuccessful (image not shown). Example error codes: 0x50000, 0x50015.
 
 **Figure 1**: Phases of a successful Windows 10 upgrade (uninstall is not shown):
 
@@ -58,6 +103,7 @@ DU = Driver/device updates.<br>
 OOBE = Out of box experience.<br>
 WIM = Windows image (Microsoft)
 
+
 ## Quick fixes
 
 The following steps can resolve many Windows upgrade problems.
@@ -92,13 +138,16 @@ The following steps can resolve many Windows upgrade problems.
 
 If the upgrade process is not successful, Windows Setup will return two codes:
 
-1. **A result code**: The result code corresponds to a specific Win32 error.
-2. **An extend code**: The extend code contains information about both the *phase* in which an error occurred, and the *operation* that was being performed when the error occurred.  
+1. **A result code**: The result code corresponds to a specific Win32 or NTSTATUS error.
+2. **An extend code**: The extend code contains information about both the *phase* in which an error occurred, and the *operation* that was being performed when the error occurred.
 
 >For example, a result code of **0xC1900101** with an extend code of **0x4000D** will be returned as: **0xC1900101 - 0x4000D**.
 
 Note: If only a result code is returned, this can be because a tool is being used that was not able to capture the extend code. For example, if you are using the [Windows 10 Upgrade Assistant](https://support.microsoft.com/en-us/kb/3159635) then only a result code might be returned.
 
+>[!TIP]
+>If you are unable to locate the result and extend error codes, you can attempt to find these codes using Event Viewer.  For more information, see [Windows Error Reporting](#windows-error-reporting).
+
 ### Result codes
 
 >A result code of **0xC1900101** is generic and indicates that a rollback occurred. In most cases, the cause is a driver compatibility issue. <br>To troubleshoot a failed upgrade that has returned a result code of 0xC1900101, analyze the extend code to determine the Windows Setup phase, and see the [Resolution procedures](#resolution-procedures) section later in this topic.
@@ -201,10 +250,49 @@ The following tables provide the corresponding phase and operation for values of
 
 For example: An extend code of **0x4000D**, represents a problem during phase 4 (**0x4**) with data migration (**000D**).
 
+## Windows Error Reporting
+
+When Windows Setup fails, the result and extend code are recorded as an informational event in the Application log by Windows Error Reporting as event 1001. The event name is **WinSetupDiag02**.  You can use Event Viewer to review this event, or you can use Windows PowerShell.
+
+To use Windows PowerShell, type the following commands from an elevated Windows PowerShell prompt:
+
+```
+$events = Get-WinEvent -FilterHashtable @{LogName="Application";ID="1001";Data="WinSetupDiag02"}
+$event = [xml]$events[0].ToXml()
+$event.Event.EventData.Data
+```
+
+To use Event Viewer: 
+1. Open Event Viewer and navigate to **Windows Logs\Application**.
+2. Click **Find**, and then search for **winsetupdiag02**.
+3. Double-click the event that is highlighted.
+
+Note: For legacy operating systems, the Event Name was WinSetupDiag01. 
+
+Ten parameters are listed in the event:
+
+<table border="0">
+<tr><td>P1: The Setup Scenario (1=Media,5=WindowsUpdate,7=Media Creation Tool)</td></tr>
+<tr><td>P2: Setup Mode (x=default,1=Downlevel,5=Rollback)</td></tr>
+<tr><td>P3: New OS Architecture (x=default,0=X86,9=AMD64)</td></tr>
+<tr><td>P4: Install Result (x=default,0=Success,1=Failure,2=Cancel,3=Blocked)</td></tr>
+<tr><td><b>P5: Result Error Code</b>  (Ex: 0xc1900101)</td></tr>
+<tr><td><b>P6: Extend Error Code</b>  (Ex: 0x20017)</td></tr>
+<tr><td>P7: Source OS build (Ex: 9600)</td></tr>
+<tr><td>P8: Source OS branch (not typically available)</td></tr>
+<tr><td>P9: New OS build (Ex: 16299}</td></tr>
+<tr><td>P10: New OS branch (Ex: rs3_release}</td></tr>
+</table>
+
+The event will also contain links to log files that can be used to perform a detailed diagnosis of the error.
+
+
 ## Log files
 
 Several log files are created during each phase of the upgrade process. These log files are essential for troubleshooting upgrade problems. By default, the folders that contain these log files are hidden on the upgrade target computer. To view the log files, configure Windows Explorer to view hidden items, or use a tool to automatically gather these logs. The most useful log is **setupact.log**. The log files are located in a different folder depending on the Windows Setup phase. Recall that you can determine the phase from the extend code. 
 
+Note: Also see the [Windows Error Reporting](#windows-error-reporting) section in this document for help locating error codes and log files. 
+
 The following table describes some log files and how to use them for troubleshooting purposes:<br>
 
 <br>
diff --git a/windows/deployment/upgrade/submit-errors.md b/windows/deployment/upgrade/submit-errors.md
new file mode 100644
index 0000000000..e497caf317
--- /dev/null
+++ b/windows/deployment/upgrade/submit-errors.md
@@ -0,0 +1,69 @@
+---
+title: Submit Windows 10 upgrade errors using Feedback Hub
+description: Submit Windows 10 upgrade errors for diagnosis using feedback hub
+keywords: deploy, error, troubleshoot, windows, 10, upgrade, code, rollback, feedback
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: deploy
+author: greg-lindsay
+ms.date: 02/01/2018
+ms.localizationpriority: high
+---
+
+# Submit Windows 10 upgrade errors using Feedback Hub
+
+**Applies to**
+-   Windows 10
+
+## In this topic
+
+This topic describes how to submit problems with a Windows 10 upgrade to Microsoft using the Windows 10 Feedback Hub.
+
+## About the Feedback Hub
+
+The Feedback Hub app lets you tell Microsoft about any problems you run in to while using Windows 10 and send suggestions to help us improve your Windows experience. Previously, you could only use the Feedback Hub if you were in the Windows Insider Program. Now anyone can use this tool.  You can download the Feedback Hub app from the Microsoft Store [here](https://www.microsoft.com/en-us/store/p/feedback-hub/9nblggh4r32n?SilentAuth=1&wa=wsignin1.0).
+
+The Feedback Hub requires Windows 10 or Windows 10 mobile. If you are having problems upgrading from an older version of Windows to Windows 10, you can use the Feedback Hub to submit this information, but you must collect the log files from the legacy operating system and then attach these files to your feedback using a device that is running Windows 10. If you are upgrading to Windows 10 from a previous verion of Windows 10, the Feedback Hub will collect log files automatically.
+
+## Submit feedback
+
+To submit feedback about a failed Windows 10 upgrade, click the following link: [Feedback Hub](feedback-hub://?referrer=resolveUpgradeErrorsPage&tabid=2&contextid=81&newFeedback=true&feedbackType=2&topic=submit-errors.md) 
+
+The Feedback Hub will open.
+
+- Under **Tell us about it**, and then under **Summarize your issue**, type **Upgrade failing**.
+- Under **Give us more detail**, provide additional information about the failed upgrade, such as:
+    - When did the failures occurs?
+        - Were there any reboots?
+        - How many times did the system reboot?
+    - How did the upgrade fail?
+        - Were any error codes visible?
+        - Did the computer fail to a blue screen?
+        - Did the computer automatically roll back or did it hang, requiring you to power cycle it before it rolled back?
+- Additional details
+    - What type of security software is installed?
+    - Is the computer up to date with latest drivers and firmware?
+    - Are there any external devices connected? 
+- If you used the link above, the category and subcategory will be automatically selected. If it is not selected, choose **Install and Update** and **Windows Installation**. 
+
+You can attach a screenshot or file if desired. This is optional.
+
+Click **Submit** to send your feedback.
+
+See the following example:
+
+![feedback example](../images/feedback.png) 
+
+After you click Submit, that's all you need to do. Microsoft will receive your feedback and begin analyzing the issue.  You can check on your feedback periodically to see what solutions have been provided.
+
+## Link to your feedback
+
+After your feedback is submitted, you can email or post links to it by opening the Feedback Hub, clicking My feedback at the top, clicking the feedback item you submitted, clicking **Share**, then copying the short link that is displayed.
+
+![share](../images/share.jpg) 
+
+## Related topics
+
+[Windows 10 release information](https://technet.microsoft.com/windows/release-info.aspx)
+
diff --git a/windows/deployment/upgrade/upgrade-readiness-deployment-script.md b/windows/deployment/upgrade/upgrade-readiness-deployment-script.md
index 3e838c9578..fb04dd5bf6 100644
--- a/windows/deployment/upgrade/upgrade-readiness-deployment-script.md
+++ b/windows/deployment/upgrade/upgrade-readiness-deployment-script.md
@@ -263,7 +263,7 @@ The deployment script displays the following exit codes to let you know if it wa
 \Windows\DataCollection**</font>
         or <font size='1'>**HKLM:\SOFTWARE\Microsoft\Windows
 \CurrentVersion\Policies\DataCollection**</font></td>
-        <td>For Windows 10 machines, the **AllowTelemetry** property should be set to 1 or greater to enable data collection. The script will throw an error if this is not true. For more information, see [Configure Windows diagnostic data in your organization](https://technet.microsoft.com/itpro/windows/manage/configure-windows-diagnostic-data-in-your-organization).</td>
+        <td>For Windows 10 machines, the **AllowTelemetry** property should be set to 1 or greater to enable data collection. The script will throw an error if this is not true. For more information, see [Configure Windows diagnostic data in your organization](https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization).</td>
     </tr>
     <tr>
         <td>40 - Function **CheckTelemetryOptIn** failed with an unexpected exception. </td>
diff --git a/windows/threat-protection/TOC.md b/windows/threat-protection/TOC.md
index 42ede7cb70..58317c1029 100644
--- a/windows/threat-protection/TOC.md
+++ b/windows/threat-protection/TOC.md
@@ -254,6 +254,7 @@
 #### [Enable Exploit protection](windows-defender-exploit-guard\enable-exploit-protection.md)
 #### [Customize Exploit protection](windows-defender-exploit-guard\customize-exploit-protection.md)
 ##### [Import, export, and deploy Exploit protection configurations](windows-defender-exploit-guard\import-export-exploit-protection-emet-xml.md)
+#### [Troubleshoot Exploit protection mitigations](windows-defender-exploit-guard\troubleshoot-exploit-protection-mitigations.md)
 ### [Attack surface reduction](windows-defender-exploit-guard\attack-surface-reduction-exploit-guard.md)
 #### [Evaluate Attack surface reduction](windows-defender-exploit-guard\evaluate-attack-surface-reduction.md)
 #### [Enable Attack surface reduction](windows-defender-exploit-guard\enable-attack-surface-reduction.md)
diff --git a/windows/threat-protection/windows-defender-exploit-guard/troubleshoot-exploit-protection-mitigations.md b/windows/threat-protection/windows-defender-exploit-guard/troubleshoot-exploit-protection-mitigations.md
new file mode 100644
index 0000000000..eb71a22518
--- /dev/null
+++ b/windows/threat-protection/windows-defender-exploit-guard/troubleshoot-exploit-protection-mitigations.md
@@ -0,0 +1,217 @@
+---
+title: Deploy Exploit protection mitigations across your organization
+keywords: Exploit protection, mitigations, troubleshoot, import, export, configure, emet, convert, conversion, deploy, install
+description: Remove unwanted Exploit protection mitigations.
+search.product: eADQiWindows 10XVcnh
+ms.pagetype: security
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.sitesec: library
+ms.pagetype: security
+localizationpriority: medium
+author: andreabichsel
+ms.author: v-anbic
+ms.date: 01/31/18
+---
+
+
+
+# Troubleshoot Exploit protection mitigations
+
+
+**Applies to:**
+
+- Windows 10, version 1709
+
+
+
+**Audience**
+
+- Enterprise security administrators
+
+
+**Manageability available with**
+
+- Windows Defender Security Center app
+- PowerShell
+
+
+When you create a set of Exploit protection mitigations (known as a configuration), you might find that the configuration export and import process does not remove all unwanted mitigations.
+
+You can manually remove unwanted mitigations in Windows Defender Security Center, or you can use the following process to remove all mitigations and then import a baseline configuration file instead.
+
+1. Remove all process mitigations with this PowerShell script:
+
+    ```PowerShell
+    # Check if Admin-Privileges are available
+    function Test-IsAdmin {
+        ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")
+    }
+
+    # Delete ExploitGuard ProcessMitigations for a given key in the registry. If no other settings exist under the specified key,
+    # the key is deleted as well
+    function Remove-ProcessMitigations([Object] $Key, [string] $Name) {
+        Try {
+            if ($Key.GetValue("MitigationOptions")) {
+                Write-Host "Removing MitigationOptions for:      " $Name
+                Remove-ItemProperty -Path $Key.PSPath -Name "MitigationOptions" -ErrorAction Stop;
+            }
+            if ($Key.GetValue("MitigationAuditOptions")) {
+                Write-Host "Removing MitigationAuditOptions for: " $Name
+                Remove-ItemProperty -Path $Key.PSPath -Name "MitigationAuditOptions" -ErrorAction Stop;
+            }
+        
+            # Remove the FilterFullPath value if there is nothing else
+            if (($Key.SubKeyCount -eq 0) -and ($Key.ValueCount -eq 1) -and ($Key.GetValue("FilterFullPath"))) {
+                Remove-ItemProperty -Path $Key.PSPath -Name "FilterFullPath" -ErrorAction Stop;
+            }
+
+            # If the key is empty now, delete it
+            if (($Key.SubKeyCount -eq 0) -and ($Key.ValueCount -eq 0)) {
+                Write-Host "Removing empty Entry:                " $Name
+                Remove-Item -Path $Key.PSPath -ErrorAction Stop
+            }
+        }
+        Catch { 
+            Write-Host "ERROR:" $_.Exception.Message "- at ($MitigationItemName)" 
+        }
+    }
+
+    # Delete all ExploitGuard ProcessMitigations
+    function Remove-All-ProcessMitigations {
+        if (!(Test-IsAdmin)) {
+            throw "ERROR: No Administrator-Privileges detected!"; return 
+        }
+
+        Get-ChildItem -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" | ForEach-Object {
+            $MitigationItem = $_; 
+            $MitigationItemName = $MitigationItem.PSChildName
+
+            Try {
+                Remove-ProcessMitigations $MitigationItem $MitigationItemName
+
+                # "UseFilter" indicate full path filters may be present
+                if ($MitigationItem.GetValue("UseFilter")) {
+                    Get-ChildItem -Path $MitigationItem.PSPath | ForEach-Object {
+                        $FullPathItem = $_
+                        if ($FullPathItem.GetValue("FilterFullPath")) {
+                            $Name = $MitigationItemName + "-" + $FullPathItem.GetValue("FilterFullPath")
+                            Write-Host "Removing FullPathEntry:              " $Name
+                            Remove-ProcessMitigations $FullPathItem $Name
+                        }
+                
+                        # If there are no subkeys now, we can delete the "UseFilter" value
+                        if ($MitigationItem.SubKeyCount -eq 0) {
+                            Remove-ItemProperty -Path $MitigationItem.PSPath -Name "UseFilter" -ErrorAction Stop
+                        }
+                    }
+                }
+                if (($MitigationItem.SubKeyCount -eq 0) -and ($MitigationItem.ValueCount -eq 0)) {
+                    Write-Host "Removing empty Entry:                " $MitigationItemName
+                    Remove-Item -Path $MitigationItem.PSPath -ErrorAction Stop
+                }
+            }
+            Catch { 
+                Write-Host "ERROR:" $_.Exception.Message "- at ($MitigationItemName)" 
+            }
+        }
+    }
+
+    # Delete all ExploitGuard System-wide Mitigations
+    function Remove-All-SystemMitigations {
+
+        if (!(Test-IsAdmin)) { 
+            throw "ERROR: No Administrator-Privileges detected!"; return 
+        }
+    
+        $Kernel = Get-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel"
+
+        Try { 
+            if ($Kernel.GetValue("MitigationOptions")) 
+                { Write-Host "Removing System MitigationOptions"
+                    Remove-ItemProperty -Path $Kernel.PSPath -Name "MitigationOptions" -ErrorAction Stop;
+                }
+            if ($Kernel.GetValue("MitigationAuditOptions")) 
+                { Write-Host "Removing System MitigationAuditOptions"
+                    Remove-ItemProperty -Path $Kernel.PSPath -Name "MitigationAuditOptions" -ErrorAction Stop;
+                }
+        } Catch {
+            Write-Host "ERROR:" $_.Exception.Message "- System"
+        }
+    }
+
+    Remove-All-ProcessMitigations
+    Remove-All-SystemMitigations
+    ```
+
+2.	Create and import an XML configuration file with the following default mitigations, as described in Import, export, and deploy Exploit Protection configurations:
+
+	```xml
+     <?xml version="1.0" encoding="UTF-8"?>
+	 <root>
+	    <SystemConfig/>
+	    <AppConfig Executable="ExtExport.exe">
+		   <ASLR OverrideForceRelocateImages="false" ForceRelocateImages="false" Enable="true"/>
+		</AppConfig>
+	    <AppConfig Executable="ie4uinit.exe">
+		   <ASLR OverrideForceRelocateImages="false" ForceRelocateImages="false" Enable="true"/>
+	    </AppConfig>
+	    <AppConfig Executable="ieinstal.exe">
+		   <ASLR OverrideForceRelocateImages="false" ForceRelocateImages="false" Enable="true"/>
+        </AppConfig>
+        <AppConfig Executable="ielowutil.exe">
+	       <ASLR OverrideForceRelocateImages="false" ForceRelocateImages="false" Enable="true"/>
+        </AppConfig>
+	    <AppConfig Executable="ieUnatt.exe">
+	       <ASLR OverrideForceRelocateImages="false" ForceRelocateImages="false" Enable="true"/>
+        </AppConfig>
+	    <AppConfig Executable="iexplore.exe">
+	       <ASLR OverrideForceRelocateImages="false" ForceRelocateImages="false" Enable="true"/>
+		</AppConfig>
+	    <AppConfig Executable="mscorsvw.exe">
+		   <ExtensionPoints OverrideExtensionPoint="false" DisableExtensionPoints="true"/>
+        </AppConfig>
+        <AppConfig Executable="msfeedssync.exe">
+           <ASLR OverrideForceRelocateImages="false" ForceRelocateImages="false" Enable="true"/>
+        </AppConfig>
+        <AppConfig Executable="mshta.exe">
+           <ASLR OverrideForceRelocateImages="false" ForceRelocateImages="false" Enable="true"/>
+        </AppConfig>
+        <AppConfig Executable="ngen.exe">
+           <ExtensionPoints OverrideExtensionPoint="false" DisableExtensionPoints="true"/>
+        </AppConfig>
+        <AppConfig Executable="ngentask.exe">
+           <ExtensionPoints OverrideExtensionPoint="false" DisableExtensionPoints="true"/>
+        </AppConfig>
+        <AppConfig Executable="PresentationHost.exe">
+           <DEP Enable="true" OverrideDEP="false" EmulateAtlThunks="false"/>
+           <ASLR OverrideForceRelocateImages="false" ForceRelocateImages="false" Enable="true" OverrideBottomUp="false" HighEntropy="true" BottomUp="true"/>
+           <SEHOP Enable="true" OverrideSEHOP="false" TelemetryOnly="false"/>
+           <Heap OverrideHeap="false" TerminateOnError="true"/>
+        </AppConfig>
+        <AppConfig Executable="PrintDialog.exe">
+           <ExtensionPoints OverrideExtensionPoint="false" DisableExtensionPoints="true"/>
+        </AppConfig>
+        <AppConfig Executable="PrintIsolationHost.exe"/>
+        <AppConfig Executable="runtimebroker.exe">
+	       <ExtensionPoints OverrideExtensionPoint="false" DisableExtensionPoints="true"/>
+		</AppConfig>
+		    <AppConfig Executable="splwow64.exe"/>
+        <AppConfig Executable="spoolsv.exe"/>
+        <AppConfig Executable="svchost.exe"/>
+        <AppConfig Executable="SystemSettings.exe">
+           <ExtensionPoints OverrideExtensionPoint="false" DisableExtensionPoints="true"/>
+        </AppConfig>
+    </root>
+    ```
+
+If you haven’t already, it's a good idea to download and use the [Windows Security Baselines](https://docs.microsoft.com/en-us/windows/device-security/windows-security-baselines) to complete your Exploit protection customization.
+
+## Related topics
+
+- [Protect devices from exploits with Windows Defender Exploit Guard](exploit-protection-exploit-guard.md)
+- [Comparison with Enhanced Mitigation Experience Toolkit](emet-exploit-protection-exploit-guard.md)
+- [Evaluate Exploit protection](evaluate-exploit-protection.md)
+- [Enable Exploit protection](enable-exploit-protection.md)
+- [Configure and audit Exploit protection mitigations](customize-exploit-protection.md)
+- [Import, export, and deploy Exploit protection configurations](import-export-exploit-protection-emet-xml.md)