mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-14 14:27:22 +00:00
Merge remote-tracking branch 'refs/remotes/origin/master' into jdsb
This commit is contained in:
Jeanie Decker
commit
e411ede44e
@ -510,6 +510,9 @@
|
||||
"notification_subscribers": [
|
||||
"elizapo@microsoft.com"
|
||||
],
|
||||
"sync_notification_subscribers": [
|
||||
"daniha@microsoft.com"
|
||||
],
|
||||
"branches_to_filter": [
|
||||
""
|
||||
],
|
||||
@ -518,6 +521,7 @@
|
||||
"skip_source_output_uploading": false,
|
||||
"need_preview_pull_request": true,
|
||||
"resolve_user_profile_using_github": true,
|
||||
"contribution_branch_mappings": {},
|
||||
"dependent_repositories": [
|
||||
{
|
||||
"path_to_root": "_themes.pdf",
|
||||
@ -547,11 +551,7 @@
|
||||
]
|
||||
},
|
||||
"need_generate_pdf_url_template": true,
|
||||
"targets": {
|
||||
"Pdf": {
|
||||
"template_folder": "_themes.pdf"
|
||||
}
|
||||
},
|
||||
"targets": {},
|
||||
"need_generate_pdf": false,
|
||||
"need_generate_intellisense": false
|
||||
}
|
||||
@ -190,15 +190,15 @@ Enable the device account with Skype for Business.
|
||||
|
||||
In order to enable Skype for Business, your environment will need to meet the following prerequisites:
|
||||
|
||||
- You'll need to have Lync Online (Plan 2) or higher in your O365 plan. The plan needs to support conferencing capability.
|
||||
- If you need Enterprise Voice (PSTN telephony) using telephony service providers for the Surface Hub, you need Lync Online (Plan 3).
|
||||
- You'll need to have Skype for Business Online Standalone Plan 2 or higher in your O365 plan. The plan needs to support conferencing capability.
|
||||
- If you need Enterprise Voice (PSTN telephony) using telephony service providers for the Surface Hub, you need Skype for Business Online Standalone Plan 3.
|
||||
- Your tenant users must have Exchange mailboxes.
|
||||
- Your Surface Hub account does require a Lync Online (Plan 2) or Lync Online (Plan 3) license, but it does not require an Exchange Online license.
|
||||
- Your Surface Hub account does require a Skype for Business Online Standalone Plan 2 or Skype for Business Online Standalone Plan 3 license, but it does not require an Exchange Online license.
|
||||
|
||||
1. Start by creating a remote PowerShell session from a PC.
|
||||
|
||||
```PowerShell
|
||||
Import-Module LyncOnlineConnector
|
||||
Import-Module SkypeOnlineConnector
|
||||
$cssess=New-CsOnlineSession -Credential $cred
|
||||
Import-PSSession $cssess -AllowClobber
|
||||
```
|
||||
@ -348,15 +348,15 @@ Enable the device account with Skype for Business.
|
||||
|
||||
In order to enable Skype for Business, your environment will need to meet the following prerequisites:
|
||||
|
||||
- You'll need to have Lync Online (Plan 2) or higher in your O365 plan. The plan needs to support conferencing capability.
|
||||
- If you need Enterprise Voice (PSTN telephony) using telephony service providers for the Surface Hub, you need Lync Online (Plan 3).
|
||||
- You'll need to have Skype for Business Online Standalone Plan 2 or higher in your O365 plan. The plan needs to support conferencing capability.
|
||||
- If you need Enterprise Voice (PSTN telephony) using telephony service providers for the Surface Hub, you need Skype for Business Online Standalone Plan 3.
|
||||
- Your tenant users must have Exchange mailboxes.
|
||||
- Your Surface Hub account does require a Lync Online (Plan 2) or Lync Online (Plan 3) license, but it does not require an Exchange Online license.
|
||||
- Your Surface Hub account does require a Skype for Business Online Standalone Plan 2 or Skype for Business Online Standalone Plan 3 license, but it does not require an Exchange Online license.
|
||||
|
||||
1. Start by creating a remote PowerShell session from a PC.
|
||||
|
||||
```PowerShell
|
||||
Import-Module LyncOnlineConnector
|
||||
Import-Module SkypeOnlineConnector
|
||||
$cssess=New-CsOnlineSession -Credential $cred
|
||||
Import-PSSession $cssess -AllowClobber
|
||||
```
|
||||
@ -372,8 +372,7 @@ If you aren't sure what value to use for the `RegistrarPool` parameter in your e
|
||||
3. To enable your Surface Hub account for Skype for Business Server, run this cmdlet:
|
||||
|
||||
```PowerShell
|
||||
Enable-CsMeetingRoom -Identity $strEmail -RegistrarPool
|
||||
"sippoolbl20a04.infra.lync.com" -SipAddressType EmailAddress
|
||||
Enable-CsMeetingRoom -Identity $strEmail -RegistrarPool "sippoolbl20a04.infra.lync.com" -SipAddressType EmailAddress
|
||||
```
|
||||
|
||||
|
||||
|
||||
@ -46,9 +46,9 @@ If the tool is unsuccessful in reimaging your drive, please contact [Surface Hub
|
||||
|
||||
## Download Surface Hub Recovery Tool
|
||||
|
||||
Surface Hub Recovery Tool is available for download from [Surface Hub Tools for IT](https://www.microsoft.com/download/details.aspx?id=52210) under the file name **SurfaceHub_Recovery_v1.4.137.0.msi**.
|
||||
Surface Hub Recovery Tool is available for download from [Surface Hub Tools for IT](https://www.microsoft.com/download/details.aspx?id=52210) under the file name **SurfaceHub_Recovery_v1.14.137.0.msi**.
|
||||
|
||||
To start the download, click **Download**, choose **SurfaceHub_Recovery_v1.4.137.0.msi** from the list, and click **Next**. From the pop-up, choose one of the following:
|
||||
To start the download, click **Download**, choose **SurfaceHub_Recovery_v1.14.137.0.msi** from the list, and click **Next**. From the pop-up, choose one of the following:
|
||||
|
||||
- Click **Run** to start the installation immediately.
|
||||
- Click **Save** to copy the download to your computer for later installation.
|
||||
@ -96,4 +96,4 @@ The reimaging process appears halted/frozen | It is safe to close and restart th
|
||||
The drive isn’t recognized by the tool | Verify that the Surface Hub SSD is enumerated as a Lite-On drive, "LITEON L CH-128V2S USB Device". If the drive is recognized as another named device, your current cable isn’t compatible. Try another cable or one of the tested cable listed above.
|
||||
Error: -2147024809 | Open Disk Manager and remove the partitions on the Surface Hub drive. Disconnect and reconnect the drive to the host machine. Restart the imaging tool again.
|
||||
|
||||
If the tool is unsuccessful in reimaging your drive, please contact [Surface Hub Support](https://support.microsoft.com/help/4037644/surface-contact-surface-warranty-and-software-support).
|
||||
If the tool is unsuccessful in reimaging your drive, please contact [Surface Hub Support](https://support.microsoft.com/help/4037644/surface-contact-surface-warranty-and-software-support).
|
||||
|
||||
@ -45,9 +45,6 @@ Use the following links for more information about creating and managing virtual
|
||||
|
||||
- [How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server](appv-configure-the-client-to-receive-updates-from-the-publishing-server.md)
|
||||
|
||||
## Have a suggestion for App-V?
|
||||
|
||||
Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).<br>For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
|
||||
|
||||
## Related topics
|
||||
|
||||
|
||||
@ -112,7 +112,7 @@ Also, the pause period is calculated from the set start date. For more details,
|
||||
|
||||
## Monitor Windows Updates by using Update Compliance
|
||||
|
||||
Update Compliance, now **available in public preview**, provides a holistic view of OS update compliance, update deployment progress, and failure troubleshooting for Windows 10 devices. This new service uses diagnostic data including installation progress, Windows Update configuration, and other information to provide such insights, at no extra cost and without additional infrastructure requirements. Whether used with Windows Update for Business or other management tools, you can be assured that your devices are properly updated.
|
||||
Update Compliance provides a holistic view of OS update compliance, update deployment progress, and failure troubleshooting for Windows 10 devices. This new service uses diagnostic data including installation progress, Windows Update configuration, and other information to provide such insights, at no extra cost and without additional infrastructure requirements. Whether used with Windows Update for Business or other management tools, you can be assured that your devices are properly updated.
|
||||
|
||||
|
||||
|
||||
|
||||
@ -17,15 +17,15 @@ ms.topic: article
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 10 Mobile
|
||||
- Windows 10 Mobile
|
||||
|
||||
> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq)
|
||||
> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq)
|
||||
|
||||
You can use Group Policy settings, mobile device management (MDM) or Registry (not recommended) to configure when devices will restart after a Windows 10 update is installed. You can schedule update installation and set policies for restart, configure active hours for when restarts will not occur, or you can do both.
|
||||
|
||||
## Schedule update installation
|
||||
|
||||
In Group Policy, within **Configure Automatic Updates**, you can configure a forced restart after a specified installation time.
|
||||
In Group Policy, within **Configure Automatic Updates**, you can configure a forced restart after a specified installation time.
|
||||
|
||||
To set the time, you need to go to **Configure Automatic Updates**, select option **4 - Auto download and schedule the install**, and then enter a time in the **Scheduled install time** dropdown. Alternatively, you can specify that installation will occur during the automatic maintenance time (configured using **Computer Configuration\Administrative Templates\Windows Components\Maintenance Scheduler**).
|
||||
|
||||
@ -40,7 +40,7 @@ For a detailed description of these registry keys, see [Registry keys used to ma
|
||||
When **Configure Automatic Updates** is enabled in Group Policy, you can enable one of the following additional policies to delay an automatic reboot after update installation:
|
||||
|
||||
- **Turn off auto-restart for updates during active hours** prevents automatic restart during active hours.
|
||||
- **No auto-restart with logged on users for scheduled automatic updates installations** prevents automatic restart when a user is signed in. If a user schedules the restart in the update notification, the device will restart at the time the user specifies even if a user is signed in at the time. This policy only applies when **Configure Automatic Updates** is set to option **4-Auto download and schedule the install**.
|
||||
- **No auto-restart with logged on users for scheduled automatic updates installations** prevents automatic restart when a user is signed in. If a user schedules the restart in the update notification, the device will restart at the time the user specifies even if a user is signed in at the time. This policy only applies when **Configure Automatic Updates** is set to option **4-Auto download and schedule the install**.
|
||||
|
||||
You can also use Registry, to prevent automatic restarts when a user is signed in. Under **HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU**, set **AuOptions** to **4** and enable **NoAutoRebootWithLoggedOnUsers**. As with Group Policy, if a user schedules the restart in the update notification, it will override this setting.
|
||||
|
||||
@ -48,9 +48,9 @@ For a detailed description of these registry keys, see [Registry keys used to ma
|
||||
|
||||
## Configure active hours
|
||||
|
||||
*Active hours* identify the period of time when you expect the device to be in use. Automatic restarts after an update will occur outside of the active hours.
|
||||
*Active hours* identify the period of time when you expect the device to be in use. Automatic restarts after an update will occur outside of the active hours.
|
||||
|
||||
By default, active hours are from 8 AM to 5 PM on PCs and from 5 AM to 11 PM on phones. Users can change the active hours manually.
|
||||
By default, active hours are from 8 AM to 5 PM on PCs and from 5 AM to 11 PM on phones. Users can change the active hours manually.
|
||||
|
||||
Starting with Windows 10, version 1703, you can also specify the max active hours range. The specified range will be counted from the active hours start time.
|
||||
|
||||
@ -89,7 +89,7 @@ For a detailed description of these registry keys, see [Registry keys used to ma
|
||||
|
||||
With Windows 10, version 1703, administrators can specify the max active hours range users can set. This option gives you additional flexibility to leave some of the decision for active hours on the user's side, while making sure you allow enough time for updating. The max range is calculated from active hours start time.
|
||||
|
||||
To configure active hours max range through Group Policy, go to **Computer Configuration\Administrative Templates\Windows Components\Windows Update** and open the **Specify active hours range for auto-restarts**.
|
||||
To configure active hours max range through Group Policy, go to **Computer Configuration\Administrative Templates\Windows Components\Windows Update** and open the **Specify active hours range for auto-restarts**.
|
||||
|
||||
To configure active hours max range through MDM, use [**Update/ActiveHoursMaxRange**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider?UpdatePolicies#update-activehoursmaxrange).
|
||||
|
||||
@ -103,9 +103,9 @@ In Windows 10, version 1703, we have added settings to control restart notificat
|
||||
|
||||
### Auto-restart notifications
|
||||
|
||||
Administrators can override the default behavior for the auto-restart required notification. By default, this notification will dismiss automatically.
|
||||
Administrators can override the default behavior for the auto-restart required notification. By default, this notification will dismiss automatically.
|
||||
|
||||
To configure this behavior through Group Policy, go to **Computer Configuration\Administrative Templates\Windows Components\Windows Update** and select **Configure auto-restart required notification for updates**. When configured to **2 - User Action**, a user that gets this notification must manually dismiss it.
|
||||
To configure this behavior through Group Policy, go to **Computer Configuration\Administrative Templates\Windows Components\Windows Update** and select **Configure auto-restart required notification for updates**. When configured to **2 - User Action**, a user that gets this notification must manually dismiss it.
|
||||
|
||||
To configure this behavior through MDM, use [**Update/AutoRestartRequiredNotificationDismissal**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider?UpdatePolicies#update-AutoRestartRequiredNotificationDismissal)
|
||||
|
||||
@ -170,7 +170,7 @@ The following tables list registry values that correspond to the Group Policy se
|
||||
| Registry key | Key type | Value |
|
||||
| --- | --- | --- |
|
||||
| ActiveHoursEnd | REG_DWORD | 0-23: set active hours to end at a specific hour</br>starts with 12 AM (0) and ends with 11 PM (23) |
|
||||
| ActiveHoursStart | REG_DWORD | 0-23: set active hours to start at a specific hour</br>starts with 12 AM (0) and ends with 11 PM (23) |
|
||||
| ActiveHoursStart | REG_DWORD | 0-23: set active hours to start at a specific hour</br>starts with 12 AM (0) and ends with 11 PM (23) |
|
||||
| SetActiveHours | REG_DWORD | 0: disable automatic restart after updates outside of active hours</br>1: enable automatic restart after updates outside of active hours |
|
||||
|
||||
**HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU**
|
||||
@ -179,32 +179,24 @@ The following tables list registry values that correspond to the Group Policy se
|
||||
| --- | --- | --- |
|
||||
| AlwaysAutoRebootAtScheduledTime | REG_DWORD | 0: disable automatic reboot after update installation at scheduled time</br>1: enable automatic reboot after update installation at ascheduled time |
|
||||
| AlwaysAutoRebootAtScheduledTimeMinutes | REG_DWORD | 15-180: set automatic reboot to occur after given minutes |
|
||||
| AUOptions | REG_DWORD | 2: notify for download and automatically install updates</br>3: automatically download and notify for instllation of updates</br>4: Automatically download and schedule installation of updates</br>5: allow the local admin to configure these settings</br>**Note:** To configure restart behavior, set this value to **4** |
|
||||
| NoAutoRebootWithLoggedOnUsers | REG_DWORD | 0: disable do not reboot if users are logged on</br>1: do not reboot after an update installation if a user is logged on</br>**Note:** If disabled : Automatic Updates will notify the user that the computer will automatically restarts in 5 minutes to complete the installation |
|
||||
| AUOptions | REG_DWORD | 2: notify for download and automatically install updates</br>3: automatically download and notify for installation of updates</br>4: Automatically download and schedule installation of updates</br>5: allow the local admin to configure these settings</br>**Note:** To configure restart behavior, set this value to **4** |
|
||||
| NoAutoRebootWithLoggedOnUsers | REG_DWORD | 0: disable do not reboot if users are logged on</br>1: do not reboot after an update installation if a user is logged on</br>**Note:** If disabled : Automatic Updates will notify the user that the computer will automatically restart in 5 minutes to complete the installation |
|
||||
| ScheduledInstallTime | REG_DWORD | 0-23: schedule update installation time to a specific hour</br>starts with 12 AM (0) and ends with 11 PM (23) |
|
||||
|
||||
There are 3 different registry combinations for controlling restart behavior:
|
||||
|
||||
- To set active hours, **SetActiveHours** should be **1**, while **ActiveHoursStart** and **ActiveHoursEnd** should define the time range.
|
||||
- To schedule a specific installation and reboot time, **AUOptions** should be **4**, **ScheduledInstallTime** should specify the installation time, **AlwaysAutoRebootAtScheduledTime** set to **1** and **AlwaysAutoRebootAtScheduledTimeMinutes** should specify number of minutes to wait before rebooting.
|
||||
- To delay rebooting if a user is logged on, **AUOptions** should be **4**, while **NoAutoRebootWithLoggedOnUsers** is set to **1**.
|
||||
- To delay rebooting if a user is logged on, **AUOptions** should be **4**, while **NoAutoRebootWithLoggedOnUsers** is set to **1**.
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Update Windows 10 in the enterprise](index.md)
|
||||
- [Overview of Windows as a service](waas-overview.md)
|
||||
- [Manage updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md)
|
||||
- [Manage updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md)
|
||||
- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md)
|
||||
- [Configure BranchCache for Windows 10 updates](waas-branchcache.md)
|
||||
- [Configure Windows Update for Business](waas-configure-wufb.md)
|
||||
- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md)
|
||||
- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md)
|
||||
- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -32,7 +32,7 @@ A [glossary](#glossary) of abbreviations used in this topic is provided at the e
|
||||
| How does a customer authorize an OEM or Channel Partner to register Autopilot devices on the customer’s behalf? | Before an OEM or Channel Partner can register a device for Autopilot on behalf of a customer, the customer must first give them consent. The consent process begins with the OEM or Channel Partner sending a link to the customer, which directs the customer to a consent page in Microsoft Store for Business. The steps explaining this process are [here](registration-auth.md). |
|
||||
| Are there any restrictions if a business customer has registered devices in MSfB and later wants those devices to be managed by a CSP via the Partner Center? | The devices will need to be deleted in MSfB by the business customer before the CSP can upload and manage them in the Partner Center. |
|
||||
| Does Windows Autopilot support removing the option to enable a local administrator account? | Windows Autopilot doesn’t support removing the local admin account. However, it does support restricting the user performing AAD domain join in OOBE to a standard account (versus admin account by default).|
|
||||
| How can I test the Windows Autopilot CSV file in the Partner Center? | Only CSP Partners have access to the Partner Center portal. If you are a CSP, you can create a Sales agent user account which has access to “Devices” for testing the file. This can be done today in the Partner Center. <br><br>Go [here](https://msdn.microsoft.com/partner-center/createuseraccounts-and-set-permissions) for more information. |
|
||||
| How can I test the Windows Autopilot CSV file in the Partner Center? | Only CSP Partners have access to the Partner Center portal. If you are a CSP, you can create a Sales agent user account which has access to “Devices” for testing the file. This can be done today in the Partner Center. <br><br>Go [here](https://msdn.microsoft.com/partner-center/create-user-accounts-and-set-permissions) for more information. |
|
||||
| Must I become a Cloud Solution Provider (CSP) to participate in Windows Autopilot? | Top volume OEMs do not, as they can use the OEM Direct API. All others who choose to use MPC to register devices must become CSPs in order to access MPC. |
|
||||
| Do the different CSP levels have all the same capabilities when it comes to Windows Autopilot? | For purposes of Windows Autopilot, there are three different types of CSPs, each with different levels of authority an access: <br><br>1. <b>Direct CSP</b>: Gets direct authorization from the customer to register devices. <br><br>2. <b>Indirect CSP Provider</b>: Gets implicit permission to register devices through the relationship their CSP Reseller partner has with the customer. Indirect CSP Providers register devices through Microsoft Partner Center. <br><br>3. <b>Indirect CSP Reseller</b>: Gets direct authorization from the customer to register devices. At the same time, their indirect CSP Provider partner also gets authorization, which mean that either the Indirect Provider or the Indirect Reseller can register devices for the customer. However, the Indirect CSP Reseller must register devices through the MPC UI (manually uploading CSV file), whereas the Indirect CSP Provider has the option to register devices using the MPC APIs. |
|
||||
|
||||
|
||||
@ -36,7 +36,7 @@ To help make it easier to deploy settings to restrict connections from Windows 1
|
||||
This baseline was created in the same way as the [Windows security baselines](/windows/device-security/windows-security-baselines) that are often used to efficiently configure Windows to a known secure state.
|
||||
Running the Windows Restricted Traffic Limited Functionality Baseline on devices in your organization will allow you to quickly configure all of the settings covered in this document.
|
||||
However, some of the settings reduce the functionality and security configuration of your device and are therefore not recommended.
|
||||
Make sure should you've chosen the right settings configuration for your environment before applying.
|
||||
Make sure you've chosen the right settings configuration for your environment before applying.
|
||||
You should not extract this package to the windows\\system32 folder because it will not apply correctly.
|
||||
|
||||
>[!IMPORTANT]
|
||||
@ -342,8 +342,6 @@ You can also apply the Group Policies using the following registry keys:
|
||||
| Don't search the web or display web results in Search| HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search<br/>REG_DWORD: ConnectedSearchUseWeb <br/>Value: 0 |
|
||||
| Set what information is shared in Search | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search<br/>REG_DWORD: ConnectedSearchPrivacy <br/>Value: 3 |
|
||||
|
||||
In Windows 10, version 1507 and Windows 10, version 1511, when you enable the **Don't search the web or display web results in Search** Group Policy, you can control the behavior of whether Cortana searches the web to display web results. However, this policy only covers whether or not web search is performed. There could still be a small amount of network traffic to Bing.com to evaluate if certain Cortana components are up-to-date or not. In order to turn off that network activity completely, you can create a Windows Firewall rule to prevent outbound traffic.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>These steps are not required for devices running Windows 10, version 1607 or Windows Server 2016.
|
||||
|
||||
@ -447,8 +445,6 @@ If you're running Windows 10, version 1607, Windows Server 2016, or later:
|
||||
|
||||
- **true**. Font streaming is enabled.
|
||||
|
||||
If you're running Windows 10, version 1507 or Windows 10, version 1511, create a REG\_DWORD registry setting named **DisableFontProviders** in **HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Services\\FontCache\\Parameters** with a value of 1.
|
||||
|
||||
> [!NOTE]
|
||||
> After you apply this policy, you must restart the device for it to take effect.
|
||||
|
||||
@ -642,7 +638,6 @@ Use either Group Policy or MDM policies to manage settings for Microsoft Edge. F
|
||||
|
||||
Find the Microsoft Edge Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Edge**.
|
||||
|
||||
|
||||
| Policy | Description |
|
||||
|------------------------------------------------------|-----------------------------------------------------------------------------------------------------|
|
||||
| Allow configuration updates for the Books Library | Choose whether configuration updates are done for the Books Library. <br /> Default: Enabled |
|
||||
@ -655,19 +650,6 @@ Find the Microsoft Edge Group Policy objects under **Computer Configuration** &g
|
||||
| Configure Start pages | Choose the Start page for domain-joined devices. <br /> Set this to **\<about:blank\>** |
|
||||
| Prevent the First Run webpage from opening on Microsoft Edge | Choose whether employees see the First Run webpage. <br /> Set to: Enable |
|
||||
|
||||
The Windows 10, version 1511 Microsoft Edge Group Policy names are:
|
||||
|
||||
| Policy | Description |
|
||||
|------------------------------------------------------|-----------------------------------------------------------------------------------------------------|
|
||||
| Allow address bar drop-down list suggestions | Choose whether employees can use Address Bar drop-down list suggestions. <br /> Default: Disabled |
|
||||
| Turn off autofill | Choose whether employees can use autofill on websites. <br /> Default: Enabled |
|
||||
| Allow employees to send Do Not Track headers | Choose whether employees can send Do Not Track headers.<br /> Default: Disabled |
|
||||
| Turn off password manager | Choose whether employees can save passwords locally on their devices. <br /> Default: Enabled |
|
||||
| Turn off Address Bar search suggestions | Choose whether the Address Bar shows search suggestions. <br /> Default: Enabled |
|
||||
| Turn off the SmartScreen Filter | Choose whether SmartScreen is turned on or off. <br /> Default: Enabled |
|
||||
| Open a new tab with an empty tab | Choose whether a new tab page appears. <br /> Default: Enabled |
|
||||
| Configure corporate Home pages | Choose the corporate Home page for domain-joined devices. <br /> Set this to **about:blank** |
|
||||
|
||||
Alternatively, you can configure the Microsoft Group Policies using the following registry entries:
|
||||
|
||||
| Policy | Registry path |
|
||||
@ -1988,9 +1970,6 @@ If you're not running Windows 10, version 1607 or later, you can use the other o
|
||||
|
||||
- **Personalization** > **Lock screen** > **Background** > **Windows spotlight**, select a different background, and turn off **Get fun facts, tips, tricks and more on your lock screen**.
|
||||
|
||||
> [!NOTE]
|
||||
> In Windows 10, version 1507 and Windows 10, version 1511, this setting was named **Show me tips, tricks, and more on the lock screen**.
|
||||
|
||||
- **Personalization** > **Start** > **Occasionally show suggestions in Start**.
|
||||
|
||||
- **System** > **Notifications & actions** > **Show me tips about Windows**.
|
||||
@ -2161,3 +2140,4 @@ You can turn off automatic updates by doing one of the following. This is not re
|
||||
- **5**. Turn off automatic updates.
|
||||
|
||||
To learn more, see [Device update management](https://msdn.microsoft.com/library/windows/hardware/dn957432.aspx) and [Configure Automatic Updates by using Group Policy](https://technet.microsoft.com/library/cc720539.aspx).
|
||||
|
||||
|
||||
@ -30,7 +30,7 @@ The distributed systems on which these technologies were built involved several
|
||||
* [Public Key Infrastucture](#public-key-infrastructure)
|
||||
* [Directory Synchronization](#directory-synchronization)
|
||||
* [Federation](#federation)
|
||||
* [MultiFactor Authetication](#multifactor-authentication)
|
||||
* [MultiFactor Authentication](#multifactor-authentication)
|
||||
* [Device Registration](#device-registration)
|
||||
|
||||
## Directories ##
|
||||
@ -140,4 +140,4 @@ If your environment is already federated and supports Azure device registration,
|
||||
3. [New Installation Baseline](hello-hybrid-cert-new-install.md)
|
||||
4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md)
|
||||
5. [Configure Windows Hello for Business settings](hello-hybrid-cert-whfb-settings.md)
|
||||
6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md)
|
||||
6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md)
|
||||
|
||||
@ -62,7 +62,7 @@ The minimum required enterprise certificate authority that can be used with Wind
|
||||
|
||||
> [!IMPORTANT]
|
||||
> For Azure AD joined device to authenticate to and use on-premises resources, ensure you:
|
||||
> * Install the root certificate authority certificate for your organization in the user's trusted root certifcate store.
|
||||
> * Install the root certificate authority certificate for your organization in the user's trusted root certificate store.
|
||||
> * Publish your certificate revocation list to a location that is available to Azure AD joined devices, such as a web-based url.
|
||||
|
||||
### Section Review
|
||||
|
||||
@ -19,12 +19,12 @@ MBSA was largely used in situations where neither Microsoft Update nor a local W
|
||||
## The Solution
|
||||
A script can help you with an alternative to MBSA’s patch-compliance checking:
|
||||
|
||||
- [Using WUA to Scan for Updates Offline](https://docs.microsoft.com/previous-versions/windows/desktop/aa387290(v=vs.85)), which includes a sample .vbs script.
|
||||
- [Using WUA to Scan for Updates Offline](https://docs.microsoft.com/windows/desktop/wua_sdk/using-wua-to-scan-for-updates-offline), which includes a sample .vbs script.
|
||||
For a PowerShell alternative, see [Using WUA to Scan for Updates Offline with PowerShell](https://gallery.technet.microsoft.com/Using-WUA-to-Scan-for-f7e5e0be).
|
||||
|
||||
For example:
|
||||
|
||||
[](https://docs.microsoft.com/previous-versions/windows/desktop/aa387290(v=vs.85))
|
||||
[](https://docs.microsoft.com/windows/desktop/wua_sdk/using-wua-to-scan-for-updates-offline)
|
||||
[](https://gallery.technet.microsoft.com/Using-WUA-to-Scan-for-f7e5e0be)
|
||||
|
||||
The preceding scripts leverage the [WSUS offline scan file](https://support.microsoft.com/help/927745/detailed-information-for-developers-who-use-the-windows-update-offline) (wsusscn2.cab) to perform a scan and get the same information on missing updates as MBSA supplied. MBSA also relied on the wsusscn2.cab to determine which updates were missing from a given system without connecting to any online service or server. The wsusscn2.cab file is still available and there are currently no plans to remove or replace it.
|
||||
|
||||
@ -59,6 +59,10 @@ For more information, see [Investigate a user account](investigate-user-windows-
|
||||
## Skype for Business integration
|
||||
Enabling the Skype for Business integration gives you the ability to communicate with users using Skype for Business, email, or phone. This can be handy when you need to communicate with the user and mitigate risks.
|
||||
|
||||
>[!NOTE]
|
||||
> When a machine is being isolated from the network, there's a pop-up where you can choose to enable Outlook and Skype communications which allows communications to the user while they are disconnected from the network. This setting applies to Skype and Outlook communication when machines are in isolation mode.
|
||||
|
||||
|
||||
## Azure Advanced Threat Protection integration
|
||||
The integration with Azure Advanced Threat Protection allows you to pivot directly into another Microsoft Identity security product. Azure Advanced Threat Protection augments an investigation with additional insights about a suspected compromised account and related resources. By enabling this feature, you'll enrich the machine-based investigation capability by pivoting across the network from an identify point of view.
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user