mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-07-03 03:03:43 +00:00
Merge pull request #2206 from MicrosoftDocs/master
Publish 3/04/2020 3:41 PM PST
This commit is contained in:
Thomas Raya
GitHub
@ -15735,6 +15735,16 @@
|
||||
"source_path": "windows/deployment/upgrade/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/deployment/deploy-windows-mdt/mdt-lite-touch-components.md",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit#mdt-lite-touch-components",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/deployment/deploy-windows-mdt/key-features-in-mdt.md",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit#key-features-in-mdt",
|
||||
"redirect_document_id": false
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -22,7 +22,7 @@ Surface Hub 2S is an all-in-one collaboration canvas that’s built for teamwork
|
||||
|**Mobile Device Management and UEFI manageability**| Manage settings and policies using a mobile device management (MDM) provider. <br> <br> Full integration with Surface Enterprise Management Mode (SEMM) lets you manage hardware components and firmware. | [Managing Surface Hub 2S with Microsoft Intune](surface-hub-2s-manage-intune.md) <br> <br> [Surface Enterprise Management Mode](https://docs.microsoft.com/surface/surface-enterprise-management-mode) |
|
||||
|**Cloud and on-premises coexistence**| Supports on-premises, hybrid, or online. | [Prepare your environment for Microsoft Surface Hub 2S](surface-hub-2s-prepare-environment.md) |
|
||||
|**Reset and recovery**| Restore from the cloud or USB drive. | [Recover and reset Surface Hub 2S](surface-hub-2s-recover-reset.md) |
|
||||
|**Microsoft Whiteboard**| Ofice 365 integration, intelligent ink, and Bing search bring powerful new capabilities, enabling a persistent digital canvas shareable across most browsers, Windows and iOS devices. | [Announcing a new whiteboard for your Surface Hub](https://techcommunity.microsoft.com/t5/Office-365-Blog/Announcing-a-new-Whiteboard-for-your-Surface-Hub/ba-p/637050) |
|
||||
|**Microsoft Whiteboard**| Office 365 integration, intelligent ink, and Bing search bring powerful new capabilities, enabling a persistent digital canvas shareable across most browsers, Windows and iOS devices. | [Announcing a new whiteboard for your Surface Hub](https://techcommunity.microsoft.com/t5/Office-365-Blog/Announcing-a-new-Whiteboard-for-your-Surface-Hub/ba-p/637050) |
|
||||
|**Microsoft Teams Meeting Room License**| Extends Office 365 licensing options across Skype for Business, Microsoft Teams, and Intune. | [Teams Meeting Room Licensing Update](https://docs.microsoft.com/MicrosoftTeams/room-systems/skype-room-systems-v2-0) |
|
||||
|**On-screen display**| Adjust volume, brightness, and input control directly on the display. | |
|
||||
|**Sensor-activated Connected Standby**| Doppler sensor activates Connected Standby after 1 minute of inactivity.<br> <br> Manage this setting remotely using Intune or directly on the device from the Settings app. | [Surface Hub 2S tech specs](surface-hub-2s-techspecs.md) |
|
||||
|
||||
@ -24,6 +24,18 @@ Please refer to the “[Surface Hub Important Information](https://support.micro
|
||||
|
||||
## Windows 10 Team Creators Update 1703
|
||||
|
||||
<details>
|
||||
<summary>February 11, 2020—update for Team edition based on KB4537765* (OS Build 15063.2284)</summary>
|
||||
|
||||
This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include:
|
||||
|
||||
* Resolves an issue where the Hub 2S cannot be heard well by other participants during Skype for Business calls.
|
||||
* Improves reliability for some Arabic, Hebrew, and other RTL language usage scenarios on Surface Hub.
|
||||
|
||||
Please refer to the [Surface Hub Admin guide](https://docs.microsoft.com/surface-hub/) for enabling/disabling device features and services.
|
||||
*[KB4537765](https://support.microsoft.com/help/4537765)
|
||||
</details>
|
||||
|
||||
<details>
|
||||
<summary>January 14, 2020—update for Team edition based on KB4534296* (OS Build 15063.2254)</summary>
|
||||
|
||||
|
||||
@ -79,19 +79,20 @@
|
||||
##### [Compatibility Fixes for Windows 10, Windows 8, Windows 7, and Windows Vista](planning/compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md)
|
||||
|
||||
|
||||
### [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md)
|
||||
#### [Get started with the Microsoft Deployment Toolkit (MDT)](deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit.md)
|
||||
##### [Key features in MDT](deploy-windows-mdt/key-features-in-mdt.md)
|
||||
##### [MDT Lite Touch components](deploy-windows-mdt/mdt-lite-touch-components.md)
|
||||
##### [Prepare for deployment with MDT](deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md)
|
||||
### Deploy Windows 10 with the Microsoft Deployment Toolkit (MDT)
|
||||
#### [Get started with MDT](deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit.md)
|
||||
|
||||
#### [Create a Windows 10 reference image](deploy-windows-mdt/create-a-windows-10-reference-image.md)
|
||||
#### [Deploy a Windows 10 image using MDT](deploy-windows-mdt/deploy-a-windows-10-image-using-mdt.md)
|
||||
#### [Build a distributed environment for Windows 10 deployment](deploy-windows-mdt/build-a-distributed-environment-for-windows-10-deployment.md)
|
||||
#### [Refresh a Windows 7 computer with Windows 10](deploy-windows-mdt/refresh-a-windows-7-computer-with-windows-10.md)
|
||||
#### [Replace a Windows 7 computer with a Windows 10 computer](deploy-windows-mdt/replace-a-windows-7-computer-with-a-windows-10-computer.md)
|
||||
#### [Perform an in-place upgrade to Windows 10 with MDT](deploy-windows-mdt/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md)
|
||||
#### [Configure MDT settings](deploy-windows-mdt/configure-mdt-settings.md)
|
||||
#### Deploy Windows 10 with MDT
|
||||
##### [Prepare for deployment with MDT](deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md)
|
||||
##### [Create a Windows 10 reference image](deploy-windows-mdt/create-a-windows-10-reference-image.md)
|
||||
##### [Deploy a Windows 10 image using MDT](deploy-windows-mdt/deploy-a-windows-10-image-using-mdt.md)
|
||||
##### [Build a distributed environment for Windows 10 deployment](deploy-windows-mdt/build-a-distributed-environment-for-windows-10-deployment.md)
|
||||
##### [Refresh a Windows 7 computer with Windows 10](deploy-windows-mdt/refresh-a-windows-7-computer-with-windows-10.md)
|
||||
##### [Replace a Windows 7 computer with a Windows 10 computer](deploy-windows-mdt/replace-a-windows-7-computer-with-a-windows-10-computer.md)
|
||||
##### [Perform an in-place upgrade to Windows 10 with MDT](deploy-windows-mdt/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md)
|
||||
|
||||
#### Customize MDT
|
||||
##### [Configure MDT settings](deploy-windows-mdt/configure-mdt-settings.md)
|
||||
##### [Set up MDT for BitLocker](deploy-windows-mdt/set-up-mdt-for-bitlocker.md)
|
||||
##### [Configure MDT deployment share rules](deploy-windows-mdt/configure-mdt-deployment-share-rules.md)
|
||||
##### [Configure MDT for UserExit scripts](deploy-windows-mdt/configure-mdt-for-userexit-scripts.md)
|
||||
|
||||
@ -98,20 +98,20 @@ On **MDT02**:
|
||||
|
||||
1. Create and share the **D:\\MDTProduction** folder using default permissions by entering the following at an elevated command prompt:
|
||||
|
||||
```cmd
|
||||
mkdir d:\MDTProduction
|
||||
New-SmbShare -Name "MDTProduction$" -Path "D:\MDTProduction"
|
||||
```
|
||||
```powershell
|
||||
mkdir d:\MDTProduction
|
||||
New-SmbShare -Name "MDTProduction$" -Path "D:\MDTProduction"
|
||||
```
|
||||
|
||||
2. You should see the following output:
|
||||
|
||||
```output
|
||||
C:\> New-SmbShare -Name "MDTProduction$" -Path "D:\MDTProduction"
|
||||
```output
|
||||
C:\> New-SmbShare -Name "MDTProduction$" -Path "D:\MDTProduction"
|
||||
|
||||
Name ScopeName Path Description
|
||||
---- --------- ---- -----------
|
||||
MDTProduction$ * D:\MDTProduction
|
||||
```
|
||||
Name ScopeName Path Description
|
||||
---- --------- ---- -----------
|
||||
MDTProduction$ * D:\MDTProduction
|
||||
```
|
||||
|
||||
### Configure the deployment share
|
||||
|
||||
|
||||
@ -79,7 +79,7 @@ On **MDT01**:
|
||||
1. Ensure you are signed in as **contoso\\administrator**.
|
||||
2. Modify the NTFS permissions for the **D:\\MDTBuildLab** folder by running the following command in an elevated Windows PowerShell prompt:
|
||||
|
||||
``` syntax
|
||||
``` powershell
|
||||
icacls "D:\MDTBuildLab" /grant '"CONTOSO\MDT_BA":(OI)(CI)(M)'
|
||||
grant-smbshareaccess -Name MDTBuildLab$ -AccountName "Contoso\MDT_BA" -AccessRight Full -force
|
||||
```
|
||||
|
||||
@ -101,7 +101,7 @@ On **MDT01**:
|
||||
1. Ensure you are signed in as **contoso\\administrator**.
|
||||
2. Modify the NTFS permissions for the **D:\\MDTProduction** folder by running the following command in an elevated Windows PowerShell prompt:
|
||||
|
||||
``` syntax
|
||||
``` powershell
|
||||
icacls "D:\MDTProduction" /grant '"CONTOSO\MDT_BA":(OI)(CI)(M)'
|
||||
grant-smbshareaccess -Name MDTProduction$ -AccountName "Contoso\MDT_BA" -AccessRight Full -force
|
||||
```
|
||||
|
||||
@ -1,66 +0,0 @@
|
||||
---
|
||||
title: Key features in MDT (Windows 10)
|
||||
description: The Microsoft Deployment Toolkit (MDT) has been in existence since 2003, when it was first introduced as Business Desktop Deployment (BDD) 1.0.
|
||||
ms.assetid: 858e384f-e9db-4a93-9a8b-101a503e4868
|
||||
ms.reviewer:
|
||||
manager: laurawi
|
||||
ms.author: greglin
|
||||
keywords: deploy, feature, tools, upgrade, migrate, provisioning
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.localizationpriority: medium
|
||||
ms.sitesec: library
|
||||
ms.pagetype: mdt
|
||||
audience: itpro
|
||||
author: greg-lindsay
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Key features in MDT
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
|
||||
The Microsoft Deployment Toolkit (MDT) has been in existence since 2003, when it was first introduced as Business Desktop Deployment (BDD) 1.0. The toolkit has evolved, both in functionality and popularity, and today it is considered fundamental to Windows operating system and enterprise application deployment.
|
||||
|
||||
MDT has many useful features, the most important of which are:
|
||||
- **Windows Client support.** Supports Windows 7, Windows 8, Windows 8.1, and Windows 10.
|
||||
- **Windows Server support.** Supports Windows Server 2008 R2, Windows Server 2012, and Windows Server 2012 R2.
|
||||
- **Additional operating systems support.** Supports Windows Thin PC and Windows Embedded POSReady 7, as well as Windows 8.1 Embedded Industry.
|
||||
- **UEFI support.** Supports deployment to machines using Unified Extensible Firmware Interface (UEFI) version 2.3.1.
|
||||
- **GPT support.** Supports deployment to machines that require the new GUID (globally unique identifier) partition table (GPT) format. This is related to UEFI.
|
||||
- **Enhanced Windows PowerShell support.** Provides support for running PowerShell scripts.
|
||||
|
||||
|
||||
|
||||
Figure 2. The deployment share mounted as a standard PSDrive allows for administration using PowerShell.
|
||||
|
||||
- **Add local administrator accounts.** Allows you to add multiple user accounts to the local Administrators group on the target computers, either via settings or the deployment wizard.
|
||||
- **Automated participation in CEIP and WER.** Provides configuration for participation in Windows Customer Experience Improvement Program (CEIP) and Windows Error Reporting (WER).
|
||||
- **Deploy Windows RE.** Enables deployment of a customized Windows Recovery Environment (Windows RE) as part of the task sequence.
|
||||
- **Deploy to VHD.** Provides ready-made task sequence templates for deploying Windows into a virtual hard disk (VHD) file.
|
||||
- **Improved deployment wizard.** Provides additional progress information and a cleaner UI for the Lite Touch Deployment Wizard.
|
||||
- **Monitoring.** Allows you to see the status of currently running deployments.
|
||||
- **Apply GPO Pack.** Allows you to deploy local group policy objects created by Microsoft Security Compliance Manager (SCM).
|
||||
- **Partitioning routines.** Provides improved partitioning routines to ensure that deployments work regardless of the current hard drive structure.
|
||||
- **Offline BitLocker.** Provides the capability to have BitLocker enabled during the Windows Preinstallation Environment (Windows PE) phase, thus saving hours of encryption time.
|
||||
- **USMT offline user-state migration.** Provides support for running the User State Migration Tool (USMT) capture offline, during the Windows PE phase of the deployment.
|
||||
|
||||
|
||||
|
||||
Figure 3. The offline USMT backup in action.
|
||||
|
||||
- **Install or uninstall Windows roles or features.** Enables you to select roles and features as part of the deployment wizard. MDT also supports uninstall of roles and features.
|
||||
- **Microsoft System Center 2012 Orchestrator integration.** Provides the capability to use Orchestrator runbooks as part of the task sequence.
|
||||
- **Support for DaRT.** Supports optional integration of the DaRT components into the boot image.
|
||||
- **Support for Office 2013.** Provides added support for deploying Microsoft Office Professional Plus 2013.
|
||||
- **Support for Modern UI app package provisioning.** Provisions applications based on the new Windows app package standard, which is used in Windows 8 and later.
|
||||
- **Extensibility.** Provides the capability to extend MDT far beyond the built-in features by adding custom scripts, web services, System Center Orchestrator runbooks, PowerShell scripts, and VBScripts.
|
||||
- **Upgrade task sequence.** Provides a new upgrade task sequence template that you can use to upgrade existing Windows 7, Windows 8, and Windows 8.1 systems directly to Windows 10, automatically preserving all data, settings, applications, and drivers. For more information about using this new upgrade task sequence, refer to the [Microsoft Deployment Toolkit resource page](https://go.microsoft.com/fwlink/p/?LinkId=618117).
|
||||
|
||||
## Related topics
|
||||
|
||||
[Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md)
|
||||
|
||||
[MDT Lite Touch components](mdt-lite-touch-components.md)
|
||||
|
||||
@ -1,121 +0,0 @@
|
||||
---
|
||||
title: MDT Lite Touch components (Windows 10)
|
||||
description: This topic provides an overview of the features in the Microsoft Deployment Toolkit (MDT) that support Lite Touch Installation (LTI) for Windows 10.
|
||||
ms.assetid: 7d6fc159-e338-439e-a2e6-1778d0da9089
|
||||
ms.reviewer:
|
||||
manager: laurawi
|
||||
ms.author: greglin
|
||||
keywords: deploy, install, deployment, boot, log, monitor
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.localizationpriority: medium
|
||||
ms.sitesec: library
|
||||
ms.pagetype: mdt
|
||||
audience: itpro
|
||||
author: greg-lindsay
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# MDT Lite Touch components
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
|
||||
This topic provides an overview of the features in the Microsoft Deployment Toolkit (MDT) that support Lite Touch Installation (LTI) for Windows 10. An LTI deployment strategy requires very little infrastructure or user interaction, and can be used to deploy an operating system from a network share or from a physical media, such as a USB flash drive or disc.
|
||||
When deploying the Windows operating system using MDT, most of the administration and configuration is done through the Deployment Workbench, but you also can perform many of the tasks using Windows PowerShell. The easiest way to find out how to use PowerShell in MDT is to use the Deployment Workbench to perform an operation and at the end of that task, click View Script. That will give you the PowerShell command.
|
||||
|
||||
|
||||
|
||||
Figure 4. If you click **View Script** on the right side, you will get the PowerShell code that was used to perform the task.
|
||||
|
||||
## <a href="" id="sec01"></a>Deployment shares
|
||||
|
||||
A deployment share is essentially a folder on the server that is shared and contains all the setup files and scripts needed for the deployment solution. It also holds the configuration files (called rules) that are gathered when a machine is deployed. These configuration files can reach out to other sources, like a database, external script, or web server to get additional settings for the deployment. For Lite Touch deployments, it is common to have two deployment shares: one for creating the reference images and one for deployment. For Zero Touch, it is common to have only the deployment share for creating reference images because Microsoft System Center 2012 R2 Configuration Manager deploys the image in the production environment.
|
||||
|
||||
## <a href="" id="sec02"></a>Rules
|
||||
|
||||
The rules (CustomSettings.ini and Bootstrap.ini) make up the brain of MDT. The rules control the Windows Deployment Wizard on the client and, for example, can provide the following settings to the machine being deployed:
|
||||
- Computer name
|
||||
- Domain to join, and organizational unit (OU) in Active Directory to hold the computer object
|
||||
- Whether to enable BitLocker
|
||||
- Regional settings
|
||||
You can manage hundreds of settings in the rules. For more information, see the [Microsoft Deployment Toolkit resource center](https://go.microsoft.com/fwlink/p/?LinkId=618117).
|
||||
|
||||
|
||||
|
||||
Figure 5. Example of a MDT rule. In this example, the new computer name is being calculated based on PC- plus the first seven (Left) characters from the serial number
|
||||
|
||||
## <a href="" id="sec03"></a>Boot images
|
||||
|
||||
Boot images are the Windows Preinstallation Environment (Windows PE) images that are used to start the deployment. They can be started from a CD or DVD, an ISO file, a USB device, or over the network using a Pre-Boot Execution Environment (PXE) server. The boot images connect to the deployment
|
||||
share on the server and start the deployment.
|
||||
|
||||
## <a href="" id="sec04"></a>Operating systems
|
||||
|
||||
Using the Deployment Workbench, you import the operating systems you want to deploy. You can import either the full source (like the full Windows 10 DVD/ISO) or a custom image that you have created. The full-source operating systems are primarily used to create reference images; however, they also can be used for normal deployments.
|
||||
|
||||
## <a href="" id="sec05"></a>Applications
|
||||
|
||||
Using the Deployment Workbench, you also add the applications you want to deploy. MDT supports virtually every executable Windows file type. The file can be a standard .exe file with command-line switches for an unattended install, a Microsoft Windows Installer (MSI) package, a batch file, or a VBScript. In fact, it can be just about anything that can be executed unattended. MDT also supports the new Universal Windows apps.
|
||||
|
||||
## <a href="" id="sec06"></a>Driver repository
|
||||
|
||||
You also use the Deployment Workbench to import the drivers your hardware needs into a driver repository that lives on the server, not in the image.
|
||||
|
||||
## <a href="" id="sec07"></a>Packages
|
||||
|
||||
With the Deployment Workbench, you can add any Microsoft packages that you want to use. The most commonly added packages are language packs, and the Deployment Workbench Packages node works well for those. You also can add security and other updates this way. However, we generally recommend that you use Windows Server Update Services (WSUS) for operating system updates. The rare exceptions are critical hotfixes that are not available via WSUS, packages for the boot image, or any other package that needs to be deployed before the WSUS update process starts.
|
||||
|
||||
## <a href="" id="sec08"></a>Task sequences
|
||||
|
||||
Task sequences are the heart and soul of the deployment solution. When creating a task sequence, you need to select a template. The templates are located in the Templates folder in the MDT installation directory, and they determine which default actions are present in the sequence.
|
||||
|
||||
You can think of a task sequence as a list of actions that need to be executed in a certain order. Each action can also have conditions. Some examples of actions are as follows:
|
||||
- **Gather.** Reads configuration settings from the deployment server.
|
||||
- **Format and Partition.** Creates the partition(s) and formats them.
|
||||
- **Inject Drivers.** Finds out which drivers the machine needs and downloads them from the central driver repository.
|
||||
- **Apply Operating System.** Uses ImageX to apply the image.
|
||||
- **Windows Update.** Connects to a WSUS server and updates the machine.
|
||||
|
||||
## <a href="" id="sec09"></a>Task sequence templates
|
||||
|
||||
MDT comes with nine default task sequence templates. You can also create your own templates. As long as you store them in the Templates folder, they will be available when you create a new task sequence.
|
||||
- **Sysprep and Capture task sequence.** Used to run the System Preparation (Sysprep) tool and capture an image of a reference computer.
|
||||
|
||||
**Note**
|
||||
It is preferable to use a complete build and capture instead of the Sysprep and Capture task sequence. A complete build and capture can be automated, whereas Sysprep and Capture cannot.
|
||||
|
||||
- **Standard Client task sequence.** The most frequently used task sequence. Used for creating reference images and for deploying clients in production.
|
||||
- **Standard Client Replace task sequence.** Used to run User State Migration Tool (USMT) backup and the optional full Windows Imaging (WIM) backup action. Can also be used to do a secure wipe of a machine that is going to be decommissioned.
|
||||
- **Custom task sequence.** As the name implies, a custom task sequence with only one default action (one Install Application action).
|
||||
- **Standard Server task sequence.** The default task sequence for deploying operating system images to servers. The main difference between this template and the Standard Client task sequence template is that it does not contain any USMT actions because USMT is not supported on servers.
|
||||
- **Lite Touch OEM task sequence.** Used to preload operating systems images on the computer hard drive. Typically used by computer original equipment manufacturers (OEMs) but some enterprise organizations also use this feature.
|
||||
- **Post OS Installation task sequence.** A task sequence prepared to run actions after the operating system has been deployed. Very useful for server deployments but not often used for client deployments.
|
||||
- **Deploy to VHD Client task sequence.** Similar to the Standard Client task sequence template but also creates a virtual hard disk (VHD) file on the target computer and deploys the image to the VHD file.
|
||||
- **Deploy to VHD Server task sequence.** Same as the Deploy to VHD Client task sequence but for servers.
|
||||
- **Standard Client Upgrade task sequence.** A simple task sequence template used to perform an in-place upgrade from Windows 7, Windows 8, or Windows 8.1 directly to Windows 10, automatically preserving existing data, settings, applications, and drivers.
|
||||
|
||||
## <a href="" id="sec10"></a>Selection profiles
|
||||
|
||||
Selection profiles, which are available in the Advanced Configuration node, provide a way to filter content in the Deployment Workbench. Selection profiles are used for several purposes in the Deployment Workbench and in Lite Touch deployments. For example, they can be used to:
|
||||
- Control which drivers and packages are injected into the Lite Touch (and generic) boot images.
|
||||
- Control which drivers are injected during the task sequence.
|
||||
- Control what is included in any media that you create.
|
||||
- Control what is replicated to other deployment shares.
|
||||
- Filter which task sequences and applications are displayed in the Deployment Wizard.
|
||||
|
||||
## <a href="" id="sec11"></a>Logging
|
||||
|
||||
MDT uses many log files during operating system deployments. By default the logs are client side, but by configuring the deployment settings, you can have MDT store them on the server, as well.
|
||||
|
||||
**Note**
|
||||
The easiest way to view log files is to use Configuration Manager Trace (CMTrace), which is included in the [System Center 2012 R2 Configuration Manager Toolkit](https://go.microsoft.com/fwlink/p/?LinkId=734717).
|
||||
|
||||
## <a href="" id="sec12"></a>Monitoring
|
||||
|
||||
On the deployment share, you also can enable monitoring. After you enable monitoring, you will see all running deployments in the Monitor node in the Deployment Workbench.
|
||||
|
||||
## Related topics
|
||||
|
||||
[Key features in MDT](key-features-in-mdt.md)
|
||||
|
||||
@ -35,7 +35,7 @@ For the purposes of this topic, we will use three server computers: **DC01**, **
|
||||
- Note: Although MDT supports Windows Server 2008 R2, at least Windows Server 2012 R2 or later is requried to perform the procedures in this guide.
|
||||
- **DC01** is a domain controller, DHCP server, and DNS server for <b>contoso.com</b>, representing the fictitious Contoso Corporation.
|
||||
- **MDT01** is a domain member server in contoso.com with a data (D:) drive that can store at least 200GB. MDT01 will host deployment shares and run the Windows Deployment Service. Optionally, MDT01 is also a WSUS server.
|
||||
- A second MDT server (**MDT02**) configured identially to MDT01 is optionally used to [build a distributed environment](build-a-distributed-environment-for-windows-10-deployment.md) for Windows 10 deployment. This server is located on a different subnet than MDT01 and has a different default gateway.
|
||||
- A second MDT server (**MDT02**) configured identically to MDT01 is optionally used to [build a distributed environment](build-a-distributed-environment-for-windows-10-deployment.md) for Windows 10 deployment. This server is located on a different subnet than MDT01 and has a different default gateway.
|
||||
- **HV01** is a Hyper-V host computer that is used to build a Windows 10 reference image.
|
||||
- See [Hyper-V requirements](#hyper-v-requirements) below for more information about HV01.
|
||||
|
||||
|
||||
@ -18,15 +18,26 @@ ms.topic: article
|
||||
|
||||
# Simulate a Windows 10 deployment in a test environment
|
||||
|
||||
This topic will walk you through the process of creating a simulated environment on which to test your Windows 10 deployment using MDT. When working with advanced settings and rules, especially those like database calls, it is most efficient to be able to test the settings without having to run through a complete deployment. Luckily, MDT enables you to perform a simulated deployment by running the Gather process by itself. The simulation works best when you are using a domain-joined machine (client or server). In the following example, you use the PC0001 Windows 10 client.
|
||||
For the purposes of this topic, you already will have either downloaded and installed the free Microsoft System Center 2012 R2 Configuration Manager Toolkit, or copied Configuration Manager Trace (CMTrace) if you have access to the System Center 2012 R2 Configuration Manager media. We also assume that you have downloaded the [sample Gather.ps1 script](https://go.microsoft.com/fwlink/p/?LinkId=619361) from the TechNet gallery.
|
||||
This topic will walk you through the process of creating a simulated environment on which to test your Windows 10 deployment using MDT. When working with advanced settings and rules, especially those like database calls, it is most efficient to be able to test the settings without having to run through a complete deployment. Luckily, MDT enables you to perform a simulated deployment by running the Gather process by itself. The simulation works best when you are using a domain-joined client.
|
||||
|
||||
1. On PC0001, log on as **CONTOSO\\Administrator** using the password <strong>P@ssw0rd</strong>.
|
||||
2. Using Computer Management, add the **CONTOSO\\MDT\_BA** user account to the local **Administrators** group.
|
||||
3. Log off, and then log on to PC0001 as **CONTOSO\\MDT\_BA**.
|
||||
4. Using File Explorer, create a folder named **C:\\MDT**.
|
||||
5. Copy the downloaded Gather.ps1 script to the **C:\\MDT** folder.
|
||||
6. From the **\\\\MDT01\\MDTProduction$\\Scripts** folder, copy the following files to **C:\\MDT**:
|
||||
## Test environment
|
||||
|
||||
- A Windows 10 client named **PC0001** will be used to simulate deployment. The client is joined to the contoso.com domain and has access to the Internet to required download tools and scripts.
|
||||
- It is assumed that you have performed (at least) the following procedures so that you have an MDT service account and an MDT production deployment share:
|
||||
- [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md)
|
||||
- [Create a Windows 10 reference image](create-a-windows-10-reference-image.md)
|
||||
- [Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md)
|
||||
|
||||
## Simulate deployment
|
||||
|
||||
On **PC0001**:
|
||||
|
||||
1. Sign as **contoso\\Administrator**.
|
||||
2. Download the [sample Gather.ps1 script](https://go.microsoft.com/fwlink/p/?LinkId=619361) from the TechNet gallery and copy it to a directory named **C:\MDT** on PC0001.
|
||||
3. Download and install the free [Microsoft System Center 2012 R2 Configuration Manager Toolkit](https://go.microsoft.com/fwlink/p/?LinkId=734717) on PC0001 so that you have access to the Configuration Manager Trace (cmtrace.exe) tool.
|
||||
4. Using Local Users and Groups (lusrmgr.msc), add the **contoso\\MDT\_BA** user account to the local **Administrators** group.
|
||||
5. Sign off, and then sign on to PC0001 as **contoso\\MDT\_BA**.
|
||||
6. Open the **\\\\MDT01\\MDTProduction$\\Scripts** folder and copy the following files to **C:\\MDT**:
|
||||
1. ZTIDataAccess.vbs
|
||||
2. ZTIGather.wsf
|
||||
3. ZTIGather.xml
|
||||
@ -35,36 +46,32 @@ For the purposes of this topic, you already will have either downloaded and inst
|
||||
8. In the **C:\\MDT** folder, create a subfolder named **X64**.
|
||||
9. From the **\\\\MDT01\\MDTProduction$\\Tools\\X64** folder, copy the Microsoft.BDD.Utility.dll file to **C:\\MDT\\X64**.
|
||||
|
||||
|
||||
|
||||
|
||||
Figure 6. The C:\\MDT folder with the files added for the simulation environment.
|
||||
The C:\\MDT folder with the files added for the simulation environment.
|
||||
|
||||
10. Using an elevated Windows PowerShell prompt (run as Administrator), run the following commands. Press Enter after each command:
|
||||
10. Type the following at an elevated Windows PowerShell prompt:
|
||||
``` powershell
|
||||
Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Scope Process -Force
|
||||
Set-Location C:\MDT
|
||||
.\Gather.ps1
|
||||
```
|
||||
11. Review the ZTIGather.log in the **C:\\MININT\\SMSOSD\\OSDLOGS** folder.
|
||||
When prompted, press **R** to run the gather script.
|
||||
|
||||
11. Review the ZTIGather.log in the **C:\\MININT\\SMSOSD\\OSDLOGS** folder using CMTrace.
|
||||
**Note**
|
||||
Warnings or errors with regard to the Wizard.hta are expected. If the log file looks okay, you are ready to try a real deployment.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
Figure 7. The ZTIGather.log file from PC0001, displaying some of its hardware capabilities.
|
||||
The ZTIGather.log file from PC0001.
|
||||
|
||||
## Related topics
|
||||
|
||||
[Set up MDT for BitLocker](set-up-mdt-for-bitlocker.md)
|
||||
|
||||
[Configure MDT deployment share rules](configure-mdt-deployment-share-rules.md)
|
||||
|
||||
[Configure MDT for UserExit scripts](configure-mdt-for-userexit-scripts.md)
|
||||
|
||||
[Use the MDT database to stage Windows 10 deployment information](use-the-mdt-database-to-stage-windows-10-deployment-information.md)
|
||||
|
||||
[Assign applications using roles in MDT](assign-applications-using-roles-in-mdt.md)
|
||||
|
||||
[Use web services in MDT](use-web-services-in-mdt.md)
|
||||
|
||||
[Set up MDT for BitLocker](set-up-mdt-for-bitlocker.md)<br>
|
||||
[Configure MDT deployment share rules](configure-mdt-deployment-share-rules.md)<br>
|
||||
[Configure MDT for UserExit scripts](configure-mdt-for-userexit-scripts.md)<br>
|
||||
[Use the MDT database to stage Windows 10 deployment information](use-the-mdt-database-to-stage-windows-10-deployment-information.md)<br>
|
||||
[Assign applications using roles in MDT](assign-applications-using-roles-in-mdt.md)<br>
|
||||
[Use web services in MDT](use-web-services-in-mdt.md)<br>
|
||||
[Use Orchestrator runbooks with MDT](use-orchestrator-runbooks-with-mdt.md)
|
||||
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 124 KiB After Width: | Height: | Size: 50 KiB |
@ -71,6 +71,7 @@ This happens because Windows 10, version 1903 deletes the AutopilotConfiguration
|
||||
<tr><td>Error importing Windows Autopilot devices from a .csv file<td>Ensure that you have not edited the .csv file in Microsoft Excel or an editor other than Notepad. Some of these editors can introduce extra characters causing the file format to be invalid.
|
||||
<tr><td>Windows Autopilot for existing devices does not follow the Autopilot OOBE experience.<td>Ensure that the JSON profile file is saved in <b>ANSI/ASCII</b> format, not Unicode or UTF-8.
|
||||
<tr><td><b>Something went wrong</b> is displayed page during OOBE.<td>The client is likely unable to access all the required AAD/MSA-related URLs. For more information, see <a href="windows-autopilot-requirements.md#networking-requirements">Networking requirements</a>.
|
||||
<tr><td>Using a provisioning package in combination with Windows Autopilot can cause issues, especially if the PPKG contains join, enrollment, or device name information.<td>Using PPKGs in combination with Windows Autopilot is not recommended.
|
||||
</table>
|
||||
|
||||
## Related topics
|
||||
|
||||
@ -67,10 +67,10 @@ So, as an example (this is not a device hash, but it's misaligned unpadded Base6
|
||||
Now for the padding rules. The padding character is "=". The padding character can only be at the end of the hash, and there can only be a maximum of 2 padding characters. Here's the basic logic.
|
||||
|
||||
- Does decoding the hash fail?
|
||||
- Yes: Are the last two characters "="?
|
||||
- Yes: Replace both "=" with a single "A" character, then try again
|
||||
- No: Add another "=" character at the end, then try again
|
||||
- No: That hash is valid
|
||||
- Yes: Are the last two characters "="?
|
||||
- Yes: Replace both "=" with a single "A" character, then try again
|
||||
- No: Add another "=" character at the end, then try again
|
||||
- No: That hash is valid
|
||||
|
||||
Looping the logic above on the previous example hash, we get the following permutations:
|
||||
- Q29udG9zbwAAA
|
||||
@ -128,6 +128,8 @@ On devices running a [supported version](https://docs.microsoft.com/windows/rele
|
||||
|
||||
The most common issue joining a device to Azure AD is related to Azure AD permissions. Ensure [the correct configuration is in place](windows-autopilot-requirements.md) to allow users to join devices to Azure AD. Errors can also happen if the user has exceeded the number of devices that they are allowed to join, as configured in Azure AD.
|
||||
|
||||
An Azure AD device is created upon import - it's important that this object not be deleted. It acts as Autopilot's anchor in AAD for group membership and targeting (including the profile) and can lead to join errors if it's deleted. Once this object has been deleted, to fix the issue, deleting and reimporting this autopilot hash will be necessary so it can recreate the associated object.
|
||||
|
||||
Error code 801C0003 will typically be reported on an error page titled "Something went wrong". This error means that the Azure AD join failed.
|
||||
|
||||
## Troubleshooting Intune enrollment issues
|
||||
|
||||
@ -50,6 +50,9 @@ It is currently possible to set a convenience PIN on Azure Active Directory Join
|
||||
## Can I use an external camera when my laptop is closed or docked?
|
||||
No. Windows 10 currently only supports one Windows Hello for Business camera and does not fluidly switch to an external camera when the computer is docked with the lid closed. The product group is aware of this and is investigating this topic further.
|
||||
|
||||
## Why does authentication fail immediately after provisioning Hybrid Key Trust?
|
||||
In a hybrid deployment, a user's public key must sync from Azure AD to AD before it can be used to authenticate against a domain controller. This sync is handled by Azure AD Connect and will occur during a normal sync cycle.
|
||||
|
||||
## What is the password-less strategy?
|
||||
Watch Principal Program Manager Karanbir Singh's Ignite 2017 presentation **Microsoft's guide for going password-less**.
|
||||
|
||||
@ -166,4 +169,3 @@ Windows Hello for Business can work with any third-party federation servers that
|
||||
|
||||
## Does Windows Hello for Business work with Mac and Linux clients?
|
||||
Windows Hello for Business is a feature of Windows 10. At this time, Microsoft is not developing clients for other platforms. However, Microsoft is open to third parties who are interested in moving these platforms away from passwords. Interested third parties can get more information by emailing [whfbfeedback@microsoft.com](mailto:whfbfeedback@microsoft.com?subject=collaboration).
|
||||
|
||||
|
||||
@ -64,14 +64,24 @@ Domain controllers automatically request a domain controller certificate (if pub
|
||||
By default, the Active Directory Certificate Authority provides and publishes the Kerberos Authentication certificate template. However, the cryptography configuration included in the provided template is based on older and less performant cryptography APIs. To ensure domain controllers request the proper certificate with the best available cryptography, use the Kerberos Authentication certificate template as a baseline to create an updated domain controller certificate template.
|
||||
|
||||
Sign-in to a certificate authority or management workstations with _Domain Admin_ equivalent credentials.
|
||||
|
||||
1. Open the **Certificate Authority** management console.
|
||||
|
||||
2. Right-click **Certificate Templates** and click **Manage**.
|
||||
|
||||
3. In the **Certificate Template Console**, right-click the **Kerberos Authentication** template in the details pane and click **Duplicate Template**.
|
||||
|
||||
4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2008 R2** from the **Certification Authority** list. Select **Windows 7.Server 2008 R2** from the **Certification Recipient** list.
|
||||
|
||||
5. On the **General** tab, type **Domain Controller Authentication (Kerberos)** in Template display name. Adjust the validity and renewal period to meet your enterprise’s needs.
|
||||
**Note**If you use different template names, you’ll need to remember and substitute these names in different portions of the lab.
|
||||
|
||||
> [!NOTE]
|
||||
> If you use different template names, you’ll need to remember and substitute these names in different portions of the lab.
|
||||
|
||||
6. On the **Subject Name** tab, select the **Build from this Active Directory information** button if it is not already selected. Select **None** from the **Subject name format** list. Select **DNS name** from the **Include this information in alternate subject** list. Clear all other items.
|
||||
|
||||
7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. Click **OK**.
|
||||
|
||||
8. Close the console.
|
||||
|
||||
### Superseding the existing Domain Controller certificate
|
||||
@ -81,14 +91,23 @@ Many domain controllers may have an existing domain controller certificate. The
|
||||
The Kerberos Authentication certificate template is the most current certificate template designated for domain controllers and should be the one you deploy to all your domain controllers (2008 or later). The autoenrollment feature in Windows enables you to effortlessly replace these domain controller certificates. You can use the following configuration to replace older domain controller certificates with a new certificate using the Kerberos Authentication certificate template.
|
||||
|
||||
Sign-in to a certificate authority or management workstations with _Enterprise Admin_ equivalent credentials.
|
||||
|
||||
1. Open the **Certificate Authority** management console.
|
||||
|
||||
2. Right-click **Certificate Templates** and click **Manage**.
|
||||
|
||||
3. In the **Certificate Template Console**, right-click the **Domain Controller Authentication (Kerberos)** (or the name of the certificate template you created in the previous section) template in the details pane and click **Properties**.
|
||||
|
||||
4. Click the **Superseded Templates** tab. Click **Add**.
|
||||
|
||||
5. From the **Add Superseded Template** dialog, select the **Domain Controller** certificate template and click **OK**. Click **Add**.
|
||||
|
||||
6. From the **Add Superseded Template** dialog, select the **Domain Controller Authentication** certificate template and click **OK**.
|
||||
|
||||
7. From the **Add Superseded Template dialog**, select the **Kerberos Authentication** certificate template and click **OK**.
|
||||
|
||||
8. Add any other enterprise certificate templates that were previously configured for domain controllers to the **Superseded Templates** tab.
|
||||
|
||||
9. Click **OK** and close the **Certificate Templates** console.
|
||||
|
||||
The certificate template is configured to supersede all the certificate templates provided in the certificate templates superseded templates list. However, the certificate template and the superseding of certificate templates is not active until you publish the certificate template to one or more certificate authorities.
|
||||
@ -98,16 +117,28 @@ The certificate template is configured to supersede all the certificate template
|
||||
Windows 10 clients use the https protocol when communicating with Active Directory Federation Services. To meet this need, you must issue a server authentication certificate to all the nodes in the Active Directory Federation Services farm. On-premises deployments can use a server authentication certificate issued by their enterprise PKI. You must configure a server authentication certificate template so the host running the Active Directory Federation Service can request the certificate.
|
||||
|
||||
Sign-in to a certificate authority or management workstations with _Domain Admin_ equivalent credentials.
|
||||
|
||||
1. Open the **Certificate Authority** management console.
|
||||
|
||||
2. Right-click **Certificate Templates** and click **Manage**.
|
||||
|
||||
3. In the **Certificate Template Console**, right-click the **Web Server** template in the details pane and click **Duplicate Template**.
|
||||
|
||||
4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Authority** list. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Recipient** list.
|
||||
|
||||
5. On the **General** tab, type **Internal Web Server** in **Template display name**. Adjust the validity and renewal period to meet your enterprise’s needs.
|
||||
**Note:** If you use different template names, you’ll need to remember and substitute these names in different portions of the lab.
|
||||
|
||||
> [!NOTE]
|
||||
> If you use different template names, you’ll need to remember and substitute these names in different portions of the lab.
|
||||
|
||||
6. On the **Request Handling** tab, select **Allow private key to be exported**.
|
||||
|
||||
7. On the **Subject** tab, select the **Supply in the request** button if it is not already selected.
|
||||
|
||||
8. On the **Security** tab, Click **Add**. Type **Domain Computers** in the **Enter the object names to select** box. Click **OK**. Select the **Allow** check box next to the **Enroll** permission.
|
||||
|
||||
9. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. Click **OK**.
|
||||
|
||||
10. Close the console.
|
||||
|
||||
### Unpublish Superseded Certificate Templates
|
||||
@ -117,10 +148,15 @@ The certificate authority only issues certificates based on published certificat
|
||||
The newly created domain controller authentication certificate template supersedes previous domain controller certificate templates. Therefore, you need to unpublish these certificate templates from all issuing certificate authorities.
|
||||
|
||||
Sign-in to the certificate authority or management workstation with _Enterprise Admin_ equivalent credentials.
|
||||
|
||||
1. Open the **Certificate Authority** management console.
|
||||
|
||||
2. Expand the parent node from the navigation pane.
|
||||
|
||||
3. Click **Certificate Templates** in the navigation pane.
|
||||
|
||||
4. Right-click the **Domain Controller** certificate template in the content pane and select **Delete**. Click **Yes** on the **Disable certificate templates** window.
|
||||
|
||||
5. Repeat step 4 for the **Domain Controller Authentication** and **Kerberos Authentication** certificate templates.
|
||||
|
||||
### Publish Certificate Templates to the Certificate Authority
|
||||
@ -128,13 +164,20 @@ Sign-in to the certificate authority or management workstation with _Enterprise
|
||||
The certificate authority may only issue certificates for certificate templates that are published to that certificate authority. If you have more than one certificate authority and you want that certificate authority to issue certificates based on a specific certificate template, then you must publish the certificate template to all certificate authorities that are expected to issue the certificate.
|
||||
|
||||
Sign-in to the certificate authority or management workstations with an _Enterprise Admin_ equivalent credentials.
|
||||
|
||||
1. Open the **Certificate Authority** management console.
|
||||
|
||||
2. Expand the parent node from the navigation pane.
|
||||
|
||||
3. Click **Certificate Templates** in the navigation pane.
|
||||
|
||||
4. Right-click the **Certificate Templates** node. Click **New**, and click **Certificate Template** to issue.
|
||||
|
||||
5. In the **Enable Certificates Templates** window, select the **Domain Controller Authentication (Kerberos)**, and **Internal Web Server** templates you created in the previous steps. Click **OK** to publish the selected certificate templates to the certificate authority.
|
||||
|
||||
6. If you published the Domain Controller Authentication (Kerberos) certificate template, then you should unpublish the certificate templates you included in the superseded templates list.
|
||||
* To unpublish a certificate template, right-click the certificate template you want to unpublish in the details pane of the Certificate Authority console and select **Delete**. Click **Yes** to confirm the operation.
|
||||
|
||||
\* To unpublish a certificate template, right-click the certificate template you want to unpublish in the details pane of the Certificate Authority console and select **Delete**. Click **Yes** to confirm the operation.
|
||||
|
||||
7. Close the console.
|
||||
|
||||
@ -143,23 +186,37 @@ Sign-in to the certificate authority or management workstations with an _Enterpr
|
||||
Domain controllers automatically request a certificate from the domain controller certificate template. However, the domain controller is unaware of newer certificate templates or superseded configurations on certificate templates. To continue automatic enrollment and renewal of domain controller certificates that understand newer certificate template and superseded certificate template configurations, create and configure a Group Policy object for automatic certificate enrollment and link the Group Policy object to the Domain Controllers OU.
|
||||
|
||||
1. Start the **Group Policy Management Console** (gpmc.msc)
|
||||
|
||||
2. Expand the domain and select the **Group Policy Object** node in the navigation pane.
|
||||
|
||||
3. Right-click **Group Policy object** and select **New**
|
||||
|
||||
4. Type *Domain Controller Auto Certificate Enrollment* in the name box and click **OK**.
|
||||
|
||||
5. Right-click the **Domain Controller Auto Certificate Enrollment** Group Policy object and click **Edit**.
|
||||
|
||||
6. In the navigation pane, expand **Policies** under **Computer Configuration**.
|
||||
|
||||
7. Expand **Windows Settings**, **Security Settings**, and click **Public Key Policies**.
|
||||
|
||||
8. In the details pane, right-click **Certificate Services Client – Auto-Enrollment** and select **Properties**.
|
||||
|
||||
9. Select **Enabled** from the **Configuration Model** list.
|
||||
10. Select the **Renew expired certificates**, **update pending certificates**, and **remove revoked certificates** check box.
|
||||
|
||||
10. Select the **Renew expired certificates, update pending certificates, and remove revoked certificates** check box.
|
||||
|
||||
11. Select the **Update certificates that use certificate templates** check box.
|
||||
|
||||
12. Click **OK**. Close the **Group Policy Management Editor**.
|
||||
|
||||
### Deploy the Domain Controller Auto Certificate Enrollment Group Policy Object
|
||||
|
||||
Sign-in to a domain controller or management workstations with _Domain Admin_ equivalent credentials.
|
||||
1. Start the **Group Policy Management Console** (gpmc.msc)
|
||||
2. In the navigation pane, expand the domain and expand the node that has your Active Directory domain name. Right-click the **Domain Controllers** organizational unit and click **Link an existing GPO…**
|
||||
|
||||
1. Start the **Group Policy Management Console** (gpmc.msc).
|
||||
|
||||
2. In the navigation pane, expand the domain and expand the node that has your Active Directory domain name. Right-click the **Domain Controllers** organizational unit and click **Link an existing GPO…**.
|
||||
|
||||
3. In the **Select GPO** dialog box, select **Domain Controller Auto Certificate Enrollment** or the name of the domain controller certificate enrollment Group Policy object you previously created and click **OK**.
|
||||
|
||||
### Validating your work
|
||||
|
||||
@ -72,6 +72,12 @@ In order to preview new features and provide early feedback, it is recommended t
|
||||
sudo rpm --import microsoft.asc
|
||||
```
|
||||
|
||||
- Install `yum-utils` if it is not already installed:
|
||||
|
||||
```bash
|
||||
sudo yum install yum-utils
|
||||
```
|
||||
|
||||
- Download and make usable all the metadata for the currently enabled yum repositories:
|
||||
|
||||
```bash
|
||||
@ -112,6 +118,12 @@ In order to preview new features and provide early feedback, it is recommended t
|
||||
sudo apt-get install curl
|
||||
```
|
||||
|
||||
- Install `libplist-utils` if it is not already installed:
|
||||
|
||||
```bash
|
||||
sudo apt-get install libplist-utils
|
||||
```
|
||||
|
||||
- Note your distribution and version, and identify the closest entry for it under `https://packages.microsoft.com/config`.
|
||||
|
||||
In the below command, replace *[distro]* and *[version]* with the information you've identified:
|
||||
@ -141,12 +153,7 @@ In order to preview new features and provide early feedback, it is recommended t
|
||||
- Install the Microsoft GPG public key:
|
||||
|
||||
```bash
|
||||
curl https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor > microsoft.gpg
|
||||
```
|
||||
|
||||
```bash
|
||||
sudo mv microsoft.gpg /etc/apt/trusted.gpg.d/
|
||||
|
||||
curl https://packages.microsoft.com/keys/microsoft.asc | apt-key add -
|
||||
```
|
||||
|
||||
- Install the https driver if it's not already present:
|
||||
|
||||
@ -59,7 +59,7 @@ If you can reproduce a problem, please increase the logging level, run the syste
|
||||
|
||||
If an error occurs during installation, the installer will only report a general failure.
|
||||
|
||||
The detailed log will be saved to /Library/Logs/Microsoft/mdatp/install.log. If you experience issues during installation, send us this file so we can help diagnose the cause.
|
||||
The detailed log will be saved to `/Library/Logs/Microsoft/mdatp/install.log`. If you experience issues during installation, send us this file so we can help diagnose the cause.
|
||||
|
||||
## Uninstalling
|
||||
|
||||
@ -72,6 +72,7 @@ There are several ways to uninstall Microsoft Defender ATP for Mac. Please note
|
||||
### From the command line
|
||||
|
||||
- ```sudo rm -rf '/Applications/Microsoft Defender ATP.app'```
|
||||
- ```sudo rm -rf '/Library/Application Support/Microsoft/Defender/'```
|
||||
|
||||
## Configuring from the command line
|
||||
|
||||
@ -98,6 +99,10 @@ Important tasks, such as controlling product settings and triggering on-demand s
|
||||
|EDR |Add group tag to machine. EDR tags are used for managing machine groups. For more information, please visit https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine-groups |`mdatp --edr --set-tag GROUP [name]` |
|
||||
|EDR |Remove group tag from machine |`mdatp --edr --remove-tag [name]` |
|
||||
|
||||
## Client Microsoft Defender ATP quarantine directory
|
||||
|
||||
`/Library/Application Support/Microsoft/Defender/quarantine/` contains the files quarantined by `mdatp`. The files are named after the threat trackingId. The current trackingIds is shown with `mdatp --threat --list --pretty`.
|
||||
|
||||
## Microsoft Defender ATP portal information
|
||||
|
||||
[This blog](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/edr-capabilities-for-macos-have-now-arrived/ba-p/1047801) provides detailed guidance on what to expect in Microsoft Defender ATP Security Center.
|
||||
@ -12,7 +12,7 @@ ms.localizationpriority: medium
|
||||
author: denisebmsft
|
||||
ms.author: deniseb
|
||||
ms.custom: nextgen
|
||||
ms.date: 09/03/2018
|
||||
ms.date: 03/04/2020
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
@ -24,8 +24,8 @@ manager: dansimp
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
There are two types of updates related to keeping Windows Defender Antivirus up to date:
|
||||
1. Protection updates
|
||||
|
||||
1. Protection updates
|
||||
2. Product updates
|
||||
|
||||
You can also apply [Windows security baselines](https://technet.microsoft.com/itpro/windows/keep-secure/windows-security-baselines) to quickly bring your endpoints up to a uniform level of protection.
|
||||
@ -36,15 +36,40 @@ Windows Defender Antivirus uses both [cloud-delivered protection](utilize-micros
|
||||
|
||||
The cloud-delivered protection is always on and requires an active connection to the Internet to function, while the protection updates generally occur once a day (although this can be configured). See the [Utilize Microsoft cloud-provided protection in Windows Defender Antivirus](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) topic for more details about enabling and configuring cloud-provided protection.
|
||||
|
||||
Engine updates are included with the Security intelligence updates and are released on a monthly cadence.
|
||||
|
||||
## Product updates
|
||||
|
||||
Windows Defender Antivirus requires [monthly updates](https://support.microsoft.com/help/4052623/update-for-windows-defender-antimalware-platform) (known as "engine updates" and "platform updates"), and will receive major feature updates alongside Windows 10 releases.
|
||||
Windows Defender Antivirus requires [monthly updates](https://support.microsoft.com/help/4052623/update-for-windows-defender-antimalware-platform) (known as "platform updates"), and will receive major feature updates alongside Windows 10 releases.
|
||||
|
||||
You can manage the distribution of updates through Windows Server Update Service (WSUS), with [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr/sum/understand/software-updates-introduction), or in the normal manner that you deploy Microsoft and Windows updates to endpoints in your network.
|
||||
|
||||
## Released platform and engine versions
|
||||
|
||||
Only the main version is listed in the following table as reference information:
|
||||
|
||||
Month | Platform/Client | Engine
|
||||
---|---|---
|
||||
Feb-2020 | - | 1.1.16800.x
|
||||
Jan-2020 | 4.18.2001.x | 1.1.16700.x
|
||||
Dec-2019 | - | - |
|
||||
Nov-2019 | 4.18.1911.x | 1.1.16600.x
|
||||
Oct-2019 | 4.18.1910.x | 1.1.16500.x
|
||||
Sep-2019 | 4.18.1909.x | 1.1.16400.x
|
||||
Aug-2019 | 4.18.1908.x | 1.1.16300.x
|
||||
Jul-2019 | 4.18.1907.x | 1.1.16200.x
|
||||
Jun-2019 | 4.18.1906.x | 1.1.16100.x
|
||||
May-2019 | 4.18.1905.x | 1.1.16000.x
|
||||
Apr-2019 | 4.18.1904.x | 1.1.15900.x
|
||||
Mar-2019 | 4.18.1903.x | 1.1.15800.x
|
||||
Feb-2019 | 4.18.1902.x | 1.1.15700.x
|
||||
Jan-2019 | 4.18.1901.x | 1.1.15600.x
|
||||
Dec-18 | 4.18.1812.X | 1.1.15500.x
|
||||
|
||||
|
||||
## In this section
|
||||
|
||||
Topic | Description
|
||||
Article | Description
|
||||
---|---
|
||||
[Manage how protection updates are downloaded and applied](manage-protection-updates-windows-defender-antivirus.md) | Protection updates can be delivered through a number of sources.
|
||||
[Manage when protection updates should be downloaded and applied](manage-protection-update-schedule-windows-defender-antivirus.md) | You can schedule when protection updates should be downloaded.
|
||||
|
||||
@ -14,7 +14,7 @@ author: jsuther1974
|
||||
ms.reviewer: isbrahm
|
||||
ms.author: dansimp
|
||||
manager: dansimp
|
||||
ms.date: 02/24/2020
|
||||
ms.date: 03/04/2020
|
||||
---
|
||||
|
||||
# Understand WDAC policy rules and file rules
|
||||
@ -126,3 +126,19 @@ Wildcards can be used at the beginning or end of a path rule; only one wildcard
|
||||
|
||||
> [!NOTE]
|
||||
> Due to an existing bug, you can not combine Path-based ALLOW rules with any DENY rules in a single policy. Instead, either separate DENY rules into a separate Base policy or move the Path-based ALLOW rules into a supplemental policy as described in [Deploy multiple WDAC policies.](deploy-multiple-windows-defender-application-control-policies.md)
|
||||
|
||||
## Windows Defender Application Control filename rules
|
||||
|
||||
File name rule levels provide administrators to specify the file attributes off which to base a file name rule. File name rules do not provide the same security guarantees that explicit signer rules do, as they are based on mutable access permissions. Specification of the file name level occurs when creating new policy rules. In addition, to combine file name levels found in multiple policies, you can merge multiple policies.
|
||||
|
||||
Use Table 3 to select the appropriate file name level for your available administrative resources and Windows Defender Application Control deployment scenario.
|
||||
|
||||
**Table 3. Windows Defender Application Control policy - filename levels**
|
||||
|
||||
| Rule level | Description |
|
||||
|----------- | ----------- |
|
||||
| **File Description** | Specifies the file description provided by the developer of the binary. |
|
||||
| **Internal Name** | Specifies the internal name of the binary. |
|
||||
| **Original File Name** | Specifies the original file name, or the name with which the file was first created, of the binary. |
|
||||
| **Package Family Name** | Specifies the package family name of the binary. The package family name consists of two parts: the name of the file and the publisher ID. |
|
||||
| **Product Name** | Specifies the name of the product with which the binary ships. |
|
||||
|
||||
@ -34,25 +34,30 @@ System Guard Secure Launch can be configured for Mobile Device Management (MDM)
|
||||
### Group Policy
|
||||
|
||||
1. Click **Start** > type and then click **Edit group policy**.
|
||||
|
||||
2. Click **Computer Configuration** > **Administrative Templates** > **System** > **Device Guard** > **Turn On Virtualization Based Security** > **Secure Launch Configuration**.
|
||||
|
||||
|
||||
|
||||
|
||||
### Windows Security Center
|
||||
|
||||
Click **Start** > **Settings** > **Update & Security** > **Windows Security** > **Open Windows Security** > **Device security** > **Core isolation** > **Firmware protection**.
|
||||
|
||||
|
||||
|
||||
|
||||
### Registry
|
||||
|
||||
1. Open Registry editor.
|
||||
|
||||
2. Click **HKEY_LOCAL_MACHINE** > **SYSTEM** > **CurrentControlSet** > **Control** > **DeviceGuard** > **Scenarios**.
|
||||
|
||||
3. Right-click **Scenarios** > **New** > **Key** and name the new key **SystemGuard**.
|
||||
|
||||
4. Right-click **SystemGuard** > **New** > **DWORD (32-bit) Value** and name the new DWORD **Enabled**.
|
||||
|
||||
5. Double-click **Enabled**, change the value to **1**, and click **OK**.
|
||||
|
||||
|
||||
|
||||
|
||||
> [!IMPORTANT]
|
||||
> If System Guard is enabled with a registry key, standard hardware security is not available for the Intel i5 7200U processor.
|
||||
@ -63,8 +68,8 @@ To verify that Secure Launch is running, use System Information (MSInfo32). Clic
|
||||
|
||||
|
||||
|
||||
>[!NOTE]
|
||||
>To enable System Guard Secure launch, the platform must meet all the baseline requirements for [Device Guard](https://docs.microsoft.com/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control), [Credential Guard](https://docs.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard-requirements), and [Virtualization Based Security](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/enable-virtualization-based-protection-of-code-integrity).
|
||||
> [!NOTE]
|
||||
> To enable System Guard Secure launch, the platform must meet all the baseline requirements for [Device Guard](https://docs.microsoft.com/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control), [Credential Guard](https://docs.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard-requirements), and [Virtualization Based Security](https://docs.microsoft.com/windows-hardware/design/device-experiences/oem-vbs).
|
||||
|
||||
## System requirements for System Guard
|
||||
|
||||
|
||||
Reference in New Issue
Block a user