From 424ab7e8c21a14f3c36c31f1564ca6d28251a7b8 Mon Sep 17 00:00:00 2001 From: Pawel Lakomski <34425146+pawellakomski@users.noreply.github.com> Date: Thu, 4 Jul 2024 10:49:44 +0200 Subject: [PATCH 01/41] Update windows-subscription-activation.md Incorrectly set comment was visible in the website. --- windows/deployment/windows-subscription-activation.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-subscription-activation.md b/windows/deployment/windows-subscription-activation.md index 539f012a42..034308a993 100644 --- a/windows/deployment/windows-subscription-activation.md +++ b/windows/deployment/windows-subscription-activation.md @@ -135,7 +135,7 @@ With Windows Enterprise or Education editions, an organization can benefit from To compare Windows editions and review pricing, see the following sites: -- [Compare Windows editions](https://www.microsoft.com/en-us/windows/business/windows-10-pro-vs-windows-11-pro) - [Enterprise Mobility + Security Pricing Options](https://www.microsoft.com/microsoft-365/enterprise-mobility-security/compare-plans-and-pricing) Benefits of moving to Windows as an online service include: From 5e3e82391249d2aba3fd3edfbebe0d8e13c63cce Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 8 Jul 2024 09:47:42 -0400 Subject: [PATCH 02/41] WHFB Azure MFA updates --- .../deploy/hybrid-cert-trust-enroll.md | 2 +- .../deploy/hybrid-cert-trust.md | 8 +++--- .../deploy/hybrid-cloud-kerberos-trust.md | 2 +- .../deploy/hybrid-key-trust-enroll.md | 4 +-- .../hello-for-business/deploy/index.md | 13 +++++++--- .../deploy/on-premises-cert-trust-enroll.md | 2 +- .../deploy/on-premises-key-trust-enroll.md | 2 +- .../hello-for-business/faq.yml | 6 ++--- .../hello-deployment-issues.md | 4 +-- .../hello-errors-during-pin-creation.md | 4 +-- .../hello-hybrid-aadj-sso-cert.md | 4 +-- .../hello-for-business/pin-reset.md | 26 ++++++++++++------- .../hello-for-business/webauthn-apis.md | 25 +++++++++++++----- 13 files changed, 62 insertions(+), 40 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-enroll.md b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-enroll.md index 50ff10820c..046cff4a4d 100644 --- a/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-enroll.md +++ b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-enroll.md @@ -135,6 +135,6 @@ To better understand the authentication flows, review the following sequence dia -[AZ-4]: /azure/active-directory/devices/troubleshoot-device-dsregcmd +[AZ-4]: /entra/identity/devices/troubleshoot-device-dsregcmd [CSP-1]: /windows/client-management/mdm/passportforwork-csp [MEM-1]: /mem/intune/configuration/custom-settings-configure diff --git a/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust.md b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust.md index bbb9a72759..8b2347f411 100644 --- a/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust.md +++ b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust.md @@ -34,7 +34,7 @@ ms.topic: tutorial ## Federated authentication to Microsoft Entra ID -Windows Hello for Business hybrid certificate trust requires Active Directory to be federated with Microsoft Entra ID using AD FS. You must also configure the AD FS farm to support Azure registered devices. +Windows Hello for Business hybrid certificate trust requires Active Directory to be federated with Microsoft Entra ID using AD FS. You must also configure the AD FS farm to support Microsoft Entra registered devices. If you're new to AD FS and federation services: @@ -82,9 +82,9 @@ During Windows Hello for Business provisioning, users receive a sign-in certific > [Next: configure and validate the Public Key Infrastructure >](hybrid-cert-trust-pki.md) -[AZ-8]: /azure/active-directory/devices/hybrid-azuread-join-plan -[AZ-10]: /azure/active-directory/devices/howto-hybrid-azure-ad-join#federated-domains -[AZ-11]: /azure/active-directory/devices/hybrid-azuread-join-manual +[AZ-8]: /entra/identity/devices/hybrid-join-plan +[AZ-10]: /entra/identity/devices/how-to-hybrid-join#federated-domains +[AZ-11]: /entra/identity/devices/hybrid-join-manual [SER-2]: /windows-server/identity/ad-fs/deployment/deploying-a-federation-server-farm [SER-3]: /windows-server/identity/ad-fs/technical-reference/understanding-key-ad-fs-concepts diff --git a/windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust.md b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust.md index 9af88ba3bf..136b0f615d 100644 --- a/windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust.md +++ b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust.md @@ -202,7 +202,7 @@ The following scenarios aren't supported using Windows Hello for Business cloud -[AZ-4]: /azure/active-directory/devices/troubleshoot-device-dsregcmd +[AZ-4]: /entra/identity/devices/troubleshoot-device-dsregcmd [CSP-1]: /windows/client-management/mdm/passportforwork-csp [ENTRA-1]: /entra/identity/authentication/howto-authentication-passwordless-security-key-on-premises#install-the-azureadhybridauthenticationmanagement-module [MEM-1]: /mem/intune/configuration/custom-settings-configure diff --git a/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust-enroll.md b/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust-enroll.md index 62f5d4401e..de3ffd9240 100644 --- a/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust-enroll.md +++ b/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust-enroll.md @@ -108,7 +108,7 @@ To better understand the authentication flows, review the following sequence dia - [Microsoft Entra join authentication to Active Directory using a key](../how-it-works-authentication.md#microsoft-entra-join-authentication-to-active-directory-using-a-key) -[AZ-4]: /azure/active-directory/devices/troubleshoot-device-dsregcmd -[AZ-5]: /azure/active-directory/connect/active-directory-aadconnectsync-feature-scheduler +[AZ-4]: /entra/identity/devices/troubleshoot-device-dsregcmd +[AZ-5]: /entra/identity/hybrid/connect/how-to-connect-sync-feature-scheduler [CSP-1]: /windows/client-management/mdm/passportforwork-csp [MEM-1]: /mem/intune/configuration/custom-settings-configure diff --git a/windows/security/identity-protection/hello-for-business/deploy/index.md b/windows/security/identity-protection/hello-for-business/deploy/index.md index f5c412fc4f..176e016833 100644 --- a/windows/security/identity-protection/hello-for-business/deploy/index.md +++ b/windows/security/identity-protection/hello-for-business/deploy/index.md @@ -146,7 +146,9 @@ The goal of Windows Hello for Business is to move organizations away from passwo - On-premises deployments must use a multifactor option that can integrate as an AD FS multifactor adapter. Organizations can choose from non-Microsoft options that offer an AD FS MFA adapter. For more information, see [Microsoft and non-Microsoft additional authentication methods][SER-2] > [!IMPORTANT] -> As of July 1, 2019, Microsoft doesn't offer MFA Server for new deployments. New deployments that require multifactor authentication should use cloud-based Microsoft Entra multifactor authentication. Existing deployment where the MFA Server was activated prior to July 1, 2019 can download the latest version, future updates, and generate activation credentials. For more information, see [Getting started with the Azure Multi-Factor Authentication Server][ENTRA-2]. +> Beginning July 1, 2019, Microsoft doesn't offer MFA Server for new deployments. New deployments that require multifactor authentication should use cloud-based Microsoft Entra multifactor authentication. +> +>Beginning September 30, 2024, Azure Multi-Factor Authentication Server deployments will no longer service MFA requests. To ensure uninterrupted authentication services and to remain in a supported state, organizations should [migrate their users' authentication data](/entra/identity/authentication/how-to-migrate-mfa-server-to-mfa-user-authentication) to the cloud-based Azure MFA. || Deployment model | MFA options | |--|--|--| @@ -159,7 +161,6 @@ The goal of Windows Hello for Business is to move organizations away from passwo For more information: - [Configure Microsoft Entra multifactor authentication settings][ENTRA-4] -- [Configure Azure MFA as authentication provider with AD FS][SER-1] - [Manage an external authentication method in Microsoft Entra ID][ENTRA-11] #### MFA and federated authentication @@ -205,6 +206,9 @@ Hybrid and on-premises deployments use directory synchronization, however, each | **Hybrid** | Microsoft Entra Connect Sync| | **On-premises** | Azure MFA server | +> [!IMPORTANT] +>Beginning September 30, 2024, Azure Multi-Factor Authentication Server deployments will no longer service MFA requests. To ensure uninterrupted authentication services and to remain in a supported state, organizations should [migrate their users' authentication data](/entra/identity/authentication/how-to-migrate-mfa-server-to-mfa-user-authentication) to the cloud-based Azure MFA. + ## Device configuration options Windows Hello for Business provides a rich set of granular policy settings. There are two main options to configure Windows Hello for Business: configuration service provider (CSP) and group policy (GPO). @@ -240,6 +244,9 @@ Here are some considerations regarding licensing requirements for cloud services | **πŸ”²** | **On-premises** | Key | Azure MFA, if used as MFA solution | | **πŸ”²** | **On-premises** | Certificate | Azure MFA, if used as MFA solution | +> [!IMPORTANT] +>Beginning September 30, 2024, Azure Multi-Factor Authentication Server deployments will no longer service MFA requests. To ensure uninterrupted authentication services and to remain in a supported state, organizations should [migrate their users' authentication data](/entra/identity/authentication/how-to-migrate-mfa-server-to-mfa-user-authentication) to the cloud-based Azure MFA. + ## Operating System requirements ### Windows requirements @@ -291,7 +298,6 @@ Now that you've read about the different deployment options and requirements, yo [ENTRA-1]: /entra/identity/authentication/concept-mfa-howitworks -[ENTRA-2]: /entra/identity/authentication/howto-mfaserver-deploy [ENTRA-3]: /entra/identity/hybrid/connect/how-to-connect-sync-whatis [ENTRA-4]: /entra/identity/authentication/howto-mfa-mfasettings [ENTRA-5]: /entra/identity/devices/hybrid-join-plan @@ -302,7 +308,6 @@ Now that you've read about the different deployment options and requirements, yo [ENTRA-10]: /entra/identity/hybrid/connect/whatis-fed [ENTRA-11]: /entra/identity/authentication/how-to-authentication-external-method-manage -[SER-1]: /windows-server/identity/ad-fs/operations/configure-ad-fs-2016-and-azure-mfa [SER-2]: /windows-server/identity/ad-fs/operations/configure-additional-authentication-methods-for-ad-fs#microsoft-and-third-party-additional-authentication-methods [KB-1]: https://support.microsoft.com/topic/5010415 diff --git a/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-enroll.md b/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-enroll.md index ce1d4a781d..8c1de9a2d0 100644 --- a/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-enroll.md +++ b/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-enroll.md @@ -86,4 +86,4 @@ To better understand the provisioning flows, review the following sequence diagr - [Provisioning in an on-premises certificate trust deployment model](../how-it-works-provisioning.md#provisioning-in-an-on-premises-certificate-trust-deployment-model) -[AZ-4]: /azure/active-directory/devices/troubleshoot-device-dsregcmd +[AZ-4]: /entra/identity/devices/troubleshoot-device-dsregcmd diff --git a/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-enroll.md b/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-enroll.md index 85c263917f..41cea6946f 100644 --- a/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-enroll.md +++ b/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-enroll.md @@ -62,4 +62,4 @@ To better understand the provisioning flows, review the following sequence diagr - [Provisioning in an on-premises key trust deployment model](../how-it-works-provisioning.md#provisioning-in-an-on-premises-key-trust-deployment-model) -[AZ-4]: /azure/active-directory/devices/troubleshoot-device-dsregcmd +[AZ-4]: /entra/identity/devices/troubleshoot-device-dsregcmd diff --git a/windows/security/identity-protection/hello-for-business/faq.yml b/windows/security/identity-protection/hello-for-business/faq.yml index 217320345b..98723b63f6 100644 --- a/windows/security/identity-protection/hello-for-business/faq.yml +++ b/windows/security/identity-protection/hello-for-business/faq.yml @@ -150,7 +150,7 @@ sections: It's possible to Microsoft Entra register a domain joined device. If the domain joined device has a convenience PIN, sign in with the convenience PIN will no longer work. This configuration isn't supported by Windows Hello for Business. - For more information, see [Microsoft Entra registered devices](/azure/active-directory/devices/concept-azure-ad-register). + For more information, see [Microsoft Entra registered devices](/entra/identity/devices/concept-device-registration). - question: Does Windows Hello for Business work with non-Windows operating systems? answer: | Windows Hello for Business is a feature of the Windows platform. @@ -162,7 +162,7 @@ sections: Windows Hello for Business is two-factor authentication based on the observed authentication factors of: *something you have*, *something you know*, and *something that's part of you*. Windows Hello for Business incorporates two of these factors: something you have (the user's private key protected by the device's security module) and something you know (your PIN). With the proper hardware, you can enhance the user experience by introducing biometrics. By using biometrics, you can replace the "something you know" authentication factor with the "something that is part of you" factor, with the assurances that users can fall back to the "something you know factor". > [!NOTE] - > The Windows Hello for Business key meets Microsoft Entra multifactor authentication (MFA) requirements and reduces the number of MFA prompts users will see when accessing resources. For more information, see [What is a Primary Refresh Token](/azure/active-directory/devices/concept-primary-refresh-token#when-does-a-prt-get-an-mfa-claim). + > The Windows Hello for Business key meets Microsoft Entra multifactor authentication (MFA) requirements and reduces the number of MFA prompts users will see when accessing resources. For more information, see [What is a Primary Refresh Token](/entra/identity/devices/concept-primary-refresh-token#when-does-a-prt-get-an-mfa-claim). - question: Which is a better or more secure for of authentication, key or certificate? answer: | Both types of authentication provide the same security; one is not more secure than the other. @@ -203,7 +203,7 @@ sections: questions: - question: What is Windows Hello for Business cloud Kerberos trust? answer: | - Windows Hello for Business *cloud Kerberos trust* is a *trust model* that enables Windows Hello for Business deployment using the infrastructure introduced for supporting [security key sign-in on Microsoft Entra hybrid joined devices and on-premises resource access on Microsoft Entra joined devices](/azure/active-directory/authentication/howto-authentication-passwordless-security-key-on-premises). Cloud Kerberos trust is the preferred deployment model if you do not need to support certificate authentication scenarios. For more information, see [cloud Kerberos trust deployment](/windows/security/identity-protection/hello-for-business/deploy). + Windows Hello for Business *cloud Kerberos trust* is a *trust model* that enables Windows Hello for Business deployment using the infrastructure introduced for supporting [security key sign-in on Microsoft Entra hybrid joined devices and on-premises resource access on Microsoft Entra joined devices](/entra/identity/authentication/howto-authentication-passwordless-security-key-on-premises). Cloud Kerberos trust is the preferred deployment model if you do not need to support certificate authentication scenarios. For more information, see [cloud Kerberos trust deployment](/windows/security/identity-protection/hello-for-business/deploy). - question: Does Windows Hello for Business cloud Kerberos trust work in my on-premises environment? answer: | This feature doesn't work in a pure on-premises AD domain services environment. diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-issues.md b/windows/security/identity-protection/hello-for-business/hello-deployment-issues.md index 4f77b96763..e6b79420ad 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-issues.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-issues.md @@ -15,7 +15,7 @@ PIN reset on Microsoft Entra joined devices uses a flow called *web sign-in* to ### Identify PIN Reset allowed domains issue -The user can launch the PIN reset flow from the lock screen using the *I forgot my PIN* link in the PIN credential provider. Selecting the link launches a full screen UI for the PIN experience on Microsoft Entra join devices. Typically, the UI displays an Azure authentication page, where the user authenticates using Microsoft Entra credentials and completes MFA. +The user can launch the PIN reset flow from the lock screen using the *I forgot my PIN* link in the PIN credential provider. Selecting the link launches a full screen UI for the PIN experience on Microsoft Entra join devices. Typically, the UI displays an authentication page, where the user authenticates using Microsoft Entra credentials and completes MFA. In federated environments, authentication may be configured to route to AD FS or a non-Microsoft identity provider. If the PIN reset flow is launched and attempts to navigate to a federated identity provider server page, it fails and displays the *We can't open that page right now* error, if the domain for the server page isn't included in an allowlist. @@ -23,7 +23,7 @@ If you're a customer of *Azure US Government* cloud, PIN reset also attempts to ### Resolve PIN Reset allowed domains issue -To resolve the error, you can configure a list of allowed domains for PIN reset using the [ConfigureWebSignInAllowedUrls](/windows/client-management/mdm/policy-csp-authentication#authentication-configurewebsigninallowedurls) policy. For information on how to configure the policy, see [Configure allowed URLs for federated identity providers on Microsoft Entra joined devices](hello-feature-pin-reset.md#configure-allowed-urls-for-federated-identity-providers-on-azure-ad-joined-devices). +To resolve the error, you can configure a list of allowed domains for PIN reset using the [ConfigureWebSignInAllowedUrls](/windows/client-management/mdm/policy-csp-authentication#authentication-configurewebsigninallowedurls) policy. For information on how to configure the policy, see [Configure allowed URLs for federated identity providers on Microsoft Entra joined devices](hello-feature-pin-reset.md#configure-allowed-urls-for-federated-identity-providers-on-microsoft-entra-joined-devices). ## Hybrid key trust sign in broken due to user public key deletion diff --git a/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md b/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md index cfe9d5519f..0e89afb281 100644 --- a/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md +++ b/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md @@ -40,7 +40,7 @@ If the error occurs again, check the error code against the following table to s | 0x80090035 | Policy requires TPM and the device doesn't have TPM. | Change the Windows Hello for Business policy to not require a TPM. | | 0x80090036 | User canceled an interactive dialog. | User is asked to try again. | | 0x801C0003 | User isn't authorized to enroll. | Check if the user has permission to perform the operation​. | -| 0x801C000E | Registration quota reached. | Unjoin some other device that is currently joined using the same account or [increase the maximum number of devices per user](/azure/active-directory/devices/device-management-azure-portal). | +| 0x801C000E | Registration quota reached. | Unjoin some other device that is currently joined using the same account or [increase the maximum number of devices per user](/entra/identity/devices/manage-device-identities). | | 0x801C000F | Operation successful, but the device requires a reboot. | Reboot the device. | | 0x801C0010 | The AIK certificate isn't valid or trusted. | Sign out and then sign in again. | | 0x801C0011 | The attestation statement of the transport key is invalid. | Sign out and then sign in again. | @@ -53,7 +53,7 @@ If the error occurs again, check the error code against the following table to s | 0x801C03EA | Server failed to authorize user or device. | Check if the token is valid and user has permission to register Windows Hello for Business keys. | | 0x801C03EB | Server response http status isn't valid | Sign out and then sign in again. | | 0x801C03EC | Unhandled exception from server. | sign out and then sign in again. | -| 0x801C03ED | Multi-factor authentication is required for a 'ProvisionKey' operation, but wasn't performed.

-or-

Token wasn't found in the Authorization header.

-or-

Failed to read one or more objects.

-or-

The request sent to the server was invalid.

-or-

User doesn't have permissions to join to Microsoft Entra ID. | Sign out and then sign in again. If that doesn't resolve the issue, unjoin the device from Azure AD and rejoin.
Allow user(s) to join to Microsoft Entra ID under Microsoft Entra Device settings. | +| 0x801C03ED | Multi-factor authentication is required for a 'ProvisionKey' operation, but wasn't performed.

-or-

Token wasn't found in the Authorization header.

-or-

Failed to read one or more objects.

-or-

The request sent to the server was invalid.

-or-

User doesn't have permissions to join to Microsoft Entra ID. | Sign out and then sign in again. If that doesn't resolve the issue, unjoin the device from Mcirosoft Entra ID and rejoin.
Allow user(s) to join to Microsoft Entra ID under Microsoft Entra Device settings. | | 0x801C03EE | Attestation failed. | Sign out and then sign in again. | | 0x801C03EF | The AIK certificate is no longer valid. | Sign out and then sign in again. | | 0x801C03F2 | Windows Hello key registration failed. | ERROR_BAD_DIRECTORY_REQUEST. Another object with the same value for property proxyAddresses already exists. To resolve the issue, refer to [Duplicate Attributes Prevent Dirsync](/office365/troubleshoot/administration/duplicate-attributes-prevent-dirsync). Also, if no sync conflict exists, please verify that the "Mail/Email address" in Microsoft Entra ID and the Primary SMTP address are the same in the proxy address. | diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md index 558d15b2f9..3d2908e78a 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md @@ -71,7 +71,7 @@ Sign-in to computer running Microsoft Entra Connect with access equivalent to *l The easiest way to verify that the onPremisesDistingushedNamne attribute is synchronized is to use the Graph Explorer for Microsoft Graph. 1. Open a web browser and navigate to [Graph Explorer](https://developer.microsoft.com/graph/graph-explorer) -1. Select **Sign in to Graph Explorer** and provide Azure credentials +1. Select **Sign in to Graph Explorer** and provide Microsoft Entra ID credentials > [!NOTE] > To successfully query the Graph API, adequate [permissions](/graph/api/user-get?) must be granted @@ -487,7 +487,7 @@ Certificate enrollment for Microsoft Entra joined devices occurs over the Intern Ideally, you configure your Microsoft Intune SCEP certificate profile to use multiple external NDES URLs. This enables Microsoft Intune to round-robin load balance the certificate requests to identically configured NDES Servers (each NDES server can accommodate approximately 300 concurrent requests). Microsoft Intune sends these requests to Microsoft Entra Application Proxies. -Microsoft Entra Application proxies are serviced by lightweight Application Proxy Connector agents. See [What is Application Proxy](/azure/active-directory/manage-apps/application-proxy#what-is-application-proxy) for more details. These agents are installed on your on-premises, domain joined devices and make authenticated secure outbound connection to Azure, waiting to process requests from Microsoft Entra Application Proxies. You can create connector groups in Microsoft Entra ID to assign specific connectors to service specific applications. +Microsoft Entra Application proxies are serviced by lightweight Application Proxy Connector agents. See [What is Application Proxy](/entra/identity/app-proxy/#what-is-application-proxy) for more details. These agents are installed on your on-premises, domain joined devices and make authenticated secure outbound connection to Azure, waiting to process requests from Microsoft Entra Application Proxies. You can create connector groups in Microsoft Entra ID to assign specific connectors to service specific applications. Connector group automatically round-robin, load balance the Microsoft Entra application proxy requests to the connectors within the assigned connector group. This ensures Windows Hello for Business certificate requests have multiple dedicated Microsoft Entra application proxy connectors exclusively available to satisfy enrollment requests. Load balancing the NDES servers and connectors should ensure users enroll their Windows Hello for Business certificates in a timely manner. diff --git a/windows/security/identity-protection/hello-for-business/pin-reset.md b/windows/security/identity-protection/hello-for-business/pin-reset.md index 816f46365d..aabf1fc5f2 100644 --- a/windows/security/identity-protection/hello-for-business/pin-reset.md +++ b/windows/security/identity-protection/hello-for-business/pin-reset.md @@ -49,7 +49,7 @@ To register the applications, follow these steps: :::row::: :::column span="3"::: - 1. Go to the [Microsoft PIN Reset Service Production website][APP-1], and sign in as at least an [Application Administrator](/entra/identity/role-based-access-control/permissions-reference#application-administrator). Review the permissions requested by the *Microsoft Pin Reset Service Production* application and select **Accept** to give consent to the application to access your organization + 1. Go to the [Microsoft PIN Reset Service Production website][APP-1], and sign in as at least an [Application Administrator][ENT-2]. Review the permissions requested by the *Microsoft Pin Reset Service Production* application and select **Accept** to give consent to the application to access your organization :::column-end::: :::column span="1"::: :::image type="content" alt-text="Screenshot showing the PIN reset service permissions page." source="images/pin-reset/pin-reset-service-prompt.png" lightbox="images/pin-reset/pin-reset-service-prompt.png" border="true"::: @@ -57,7 +57,7 @@ To register the applications, follow these steps: :::row-end::: :::row::: :::column span="3"::: - 2. Go to the [Microsoft PIN Reset Client Production website][APP-2], and sign as at least an [Application Administrator](/entra/identity/role-based-access-control/permissions-reference#application-administrator). Review the permissions requested by the *Microsoft Pin Reset Client Production* application, and select **Next**. + 2. Go to the [Microsoft PIN Reset Client Production website][APP-2], and sign as at least an [Application Administrator][ENT-2]. Review the permissions requested by the *Microsoft Pin Reset Client Production* application, and select **Next**. :::column-end::: :::column span="1"::: :::image type="content" alt-text="Screenshot showing the PIN reset client permissions page." source="images/pin-reset/pin-reset-client-prompt.png" lightbox="images/pin-reset/pin-reset-client-prompt.png" border="true"::: @@ -76,7 +76,7 @@ To register the applications, follow these steps: ### Confirm that the two PIN Reset service principals are registered in your tenant -1. Sign in to the [Microsoft Entra Manager admin center](https://entra.microsoft.com) +1. Sign in to the [Microsoft Entra Manager admin center][ENTRA] 1. Select **Microsoft Entra ID > Applications > Enterprise applications** 1. Search by application name "Microsoft PIN" and verify that both **Microsoft Pin Reset Service Production** and **Microsoft Pin Reset Client Production** are in the list :::image type="content" alt-text="PIN reset service permissions page." source="images/pin-reset/pin-reset-applications.png" lightbox="images/pin-reset/pin-reset-applications-expanded.png"::: @@ -103,7 +103,7 @@ The following instructions provide details how to configure your devices. Select >[!NOTE] > You can also configure PIN recovery from the **Endpoint security** blade: > -> 1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) +> 1. Sign in to the [Microsoft Intune admin center][INTUNE] > 1. Select **Endpoint security > Account protection > Create Policy** Alternatively, you can configure devices using a [custom policy][INT-1] with the [PassportForWork CSP][CSP-1]. @@ -113,7 +113,7 @@ Alternatively, you can configure devices using a [custom policy][INT-1] with the | `./Vendor/MSFT/Policy/PassportForWork/`*TenantId*`/Policies/EnablePinRecovery`| Boolean | True | >[!NOTE] -> You must replace `TenantId` with the identifier of your Microsoft Entra tenant. To look up your Tenant ID, see [How to find your Microsoft Entra tenant ID](/azure/active-directory/fundamentals/how-to-find-tenant) or try the following, ensuring to sign-in with your organization's account:: +> You must replace `TenantId` with the identifier of your Microsoft Entra tenant. To look up your Tenant ID, see [How to find your Microsoft Entra tenant ID][ENT-3] or try the following, ensuring to sign-in with your organization's account:: ```msgraph-interactive GET https://graph.microsoft.com/v1.0/organization?$select=id @@ -133,7 +133,7 @@ GET https://graph.microsoft.com/v1.0/organization?$select=id #### Confirm that PIN Recovery policy is enforced on the devices -The _PIN reset_ configuration can be viewed by running [**dsregcmd /status**](/azure/active-directory/devices/troubleshoot-device-dsregcmd) from the command line. This state can be found under the output in the user state section as the **CanReset** line item. If **CanReset** reports as DestructiveOnly, then only destructive PIN reset is enabled. If **CanReset** reports DestructiveAndNonDestructive, then nondestructive PIN reset is enabled. +The _PIN reset_ configuration can be viewed by running [**dsregcmd /status**][ENT-4] from the command line. This state can be found under the output in the user state section as the **CanReset** line item. If **CanReset** reports as DestructiveOnly, then only destructive PIN reset is enabled. If **CanReset** reports DestructiveAndNonDestructive, then nondestructive PIN reset is enabled. **Sample User state Output for Destructive PIN Reset** @@ -233,12 +233,18 @@ For Microsoft Entra hybrid joined devices: > [!NOTE] > Key trust on Microsoft Entra hybrid joined devices doesn't support destructive PIN reset from above the Lock Screen. This is due to the sync delay between when a user provisions their Windows Hello for Business credential and being able to use it for sign-in. For this deployment model, you must deploy non-destructive PIN reset for above lock PIN reset to work. -You may find that PIN reset from Settings only works post sign in. Also, the lock screen PIN reset function doesn't work if you have any matching limitation of self-service password reset from the lock screen. For more information, see [Enable Microsoft Entra self-service password reset at the Windows sign-in screen](/azure/active-directory/authentication/howto-sspr-windows#general-limitations). +You may find that PIN reset from Settings only works post sign in. Also, the lock screen PIN reset function doesn't work if you have any matching limitation of self-service password reset from the lock screen. For more information, see [Enable Microsoft Entra self-service password reset at the Windows sign-in screen][ENT-1]. -[CSP-1]: /windows/client-management/mdm/passportforwork-csp -[CSP-2]: /windows/client-management/mdm/policy-csp-authentication#authentication-configurewebsigninallowedurls -[INT-1]: /mem/intune/configuration/settings-catalog [APP-1]: https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=b8456c59-1230-44c7-a4a2-99b085333e84&resource=https%3A%2F%2Fgraph.windows.net&redirect_uri=https%3A%2F%2Fcred.microsoft.com&state=e9191523-6c2f-4f1d-a4f9-c36f26f89df0&prompt=admin_consent [APP-2]: https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=9115dd05-fad5-4f9c-acc7-305d08b1b04e&resource=https%3A%2F%2Fcred.microsoft.com%2F&redirect_uri=ms-appx-web%3A%2F%2FMicrosoft.AAD.BrokerPlugin%2F9115dd05-fad5-4f9c-acc7-305d08b1b04e&state=6765f8c5-f4a7-4029-b667-46a6776ad611&prompt=admin_consent +[CSP-1]: /windows/client-management/mdm/passportforwork-csp +[CSP-2]: /windows/client-management/mdm/policy-csp-authentication#authentication-configurewebsigninallowedurls +[ENT-1]: /entra/identity/authentication/howto-sspr-windows#general-limitations +[ENT-2]: /entra/identity/role-based-access-control/permissions-reference#application-administrator +[ENT-3]: /entra/fundamentals/how-to-find-tenant +[ENT-4]: /entra/identity/devices/troubleshoot-device-dsregcmd +[ENTRA]: https://entra.microsoft.com +[INT-1]: /mem/intune/configuration/settings-catalog +[INTUNE]: https://go.microsoft.com/fwlink/?linkid=2109431 diff --git a/windows/security/identity-protection/hello-for-business/webauthn-apis.md b/windows/security/identity-protection/hello-for-business/webauthn-apis.md index f047719f37..d685983a32 100644 --- a/windows/security/identity-protection/hello-for-business/webauthn-apis.md +++ b/windows/security/identity-protection/hello-for-business/webauthn-apis.md @@ -14,7 +14,7 @@ Starting in **Windows 11, version 22H2**, WebAuthn APIs support ECC algorithms. ## What does this mean? -By using WebAuthn APIs, developer partners and the developer community can use [Windows Hello](./index.md) or [FIDO2 Security Keys](/azure/active-directory/authentication/howto-authentication-passwordless-security-key) to implement passwordless multi-factor authentication for their applications on Windows devices. +By using WebAuthn APIs, developer partners and the developer community can use [Windows Hello](./index.md) or [FIDO2 Security Keys][ENT-1] to implement passwordless multi-factor authentication for their applications on Windows devices. Users of these apps or sites can use any browser that supports WebAuthn APIs for passwordless authentication. Users will have a familiar and consistent experience on Windows, no matter which browser they use. @@ -69,7 +69,7 @@ FIDO2 authenticators have already been implemented and WebAuthn relying parties - Keys for multiple accounts (keys can be stored per relying party) - Client PIN - Location (the authenticator returns a location) -- [Hash-based Message Authentication Code (HMAC)-secret](/dotnet/api/system.security.cryptography.hmac) (enables offline scenarios) +- [Hash-based Message Authentication Code (HMAC)-secret][NET-1] (enables offline scenarios) The following options might be useful in the future, but haven't been observed in the wild yet: @@ -100,15 +100,26 @@ Here's an approximate layout of where the Microsoft bits go: - **WebAuthn client: Microsoft Edge**. Microsoft Edge can handle the user interface for the WebAuthn and CTAP2 features that this article describes. It also supports the AppID extension. Microsoft Edge can interact with both CTAP1 and CTAP2 authenticators. This scope for interaction means that it can create and use both U2F and FIDO2 credentials. However, Microsoft Edge doesn't speak the U2F protocol. Therefore, relying parties must use only the WebAuthn specification. Microsoft Edge on Android doesn't support WebAuthn. > [!NOTE] - > For authoritative information about Microsoft Edge support for WebAuthn and CTAP, see [Legacy Microsoft Edge developer documentation](/microsoft-edge/dev-guide/windows-integration/web-authentication). + > For authoritative information about Microsoft Edge support for WebAuthn and CTAP, see [Legacy Microsoft Edge developer documentation][EDGE-1]. - **Platform: Windows 10, Windows 11**. Windows 10 and Windows 11 host the Win32 Platform WebAuthn APIs. -- **Roaming Authenticators**. You might notice that there's no *Microsoft* roaming authenticator. The reason is because there's already a strong ecosystem of products that specialize in strong authentication, and every customer (whether corporations or individuals) has different requirements for security, ease of use, distribution, and account recovery. For more information on the ever-growing list of FIDO2-certified authenticators, see [FIDO Certified Products](https://fidoalliance.org/certification/fido-certified-products/). The list includes built-in authenticators, roaming authenticators, and even chip manufacturers who have certified designs. +- **Roaming Authenticators**. You might notice that there's no *Microsoft* roaming authenticator. The reason is because there's already a strong ecosystem of products that specialize in strong authentication, and every customer (whether corporations or individuals) has different requirements for security, ease of use, distribution, and account recovery. For more information on the ever-growing list of FIDO2-certified authenticators, see [FIDO Certified Products][EXT-1]. The list includes built-in authenticators, roaming authenticators, and even chip manufacturers who have certified designs. ## Developer references -The WebAuthn APIs are documented in the [Microsoft/webauthn](https://github.com/Microsoft/webauthn) GitHub repo. To understand how FIDO2 authenticators work, review the following two specifications: +The WebAuthn APIs are documented in the [Microsoft/webauthn][EXT-2] GitHub repo. To understand how FIDO2 authenticators work, review the following two specifications: -- [Web Authentication: An API for accessing Public Key Credentials](https://www.w3.org/TR/webauthn/) (available on the W3C site). This document is known as the WebAuthn spec. -- [Client to Authenticator Protocol (CTAP)](https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-client-to-authenticator-protocol-v2.0-id-20180227.html). This document is available at the [FIDO Alliance](http://fidoalliance.org/) site, on which hardware and platform teams are working together to solve the problem of FIDO authentication. +- [Web Authentication: An API for accessing Public Key Credentials][EXT-3] (available on the W3C site). This document is known as the WebAuthn spec. +- [Client to Authenticator Protocol (CTAP)][EXT-4]. This document is available at the [FIDO Alliance][EXT-5] site, on which hardware and platform teams are working together to solve the problem of FIDO authentication. + + + +[ENT-1]: /entra/identity/authentication/how-to-enable-passkey-fido2 +[NET-1]: /dotnet/api/system.security.cryptography.hmac +[EDGE-1]: /microsoft-edge/dev-guide/windows-integration/web-authentication +[EXT-1]: https://fidoalliance.org/certification/fido-certified-products/ +[EXT-2]: https://github.com/Microsoft/webauthn +[EXT-3]: https://www.w3.org/TR/webauthn/ +[EXT-4]: https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-client-to-authenticator-protocol-v2.0-id-20180227.html +[EXT-5]: http://fidoalliance.org From ef8a0f16c68d1ee44dd26677913862588beb1f77 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 8 Jul 2024 11:15:23 -0400 Subject: [PATCH 03/41] Added recovery password details --- .../bitlocker/operations-guide.md | 30 +++++++++++++++++++ .../bitlocker/recovery-process.md | 9 +++++- 2 files changed, 38 insertions(+), 1 deletion(-) diff --git a/windows/security/operating-system-security/data-protection/bitlocker/operations-guide.md b/windows/security/operating-system-security/data-protection/bitlocker/operations-guide.md index 29452a46ea..c41b4ab0cb 100644 --- a/windows/security/operating-system-security/data-protection/bitlocker/operations-guide.md +++ b/windows/security/operating-system-security/data-protection/bitlocker/operations-guide.md @@ -610,7 +610,37 @@ Once decryption is complete, the drive updates its status in the Control Panel a --- +## Unlock a drive + +If connect a drive as a secondary drive to a device, and you have your BitLocker recovery key, you can unlock a BitLocker-enabled drive by using the following instructions. + +In the next example, the `D` drive is the one to unlock. Select the option that best suits your needs. + +#### [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) + +```powershell +Unlock-BitLocker -MountPoint D -RecoveryPassword xxxxxx-xxxxxx-xxxxxx-xxxxxx-xxxxxx-xxxxxx-xxxxxx-xxxxxx +``` + +For more information, see [Unlock-BitLocker][PS-2] + +#### [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) + +```cmd +manage-bde.exe -unlock D: -recoverypassword xxxxxx-xxxxxx-xxxxxx-xxxxxx-xxxxxx-xxxxxx-xxxxxx-xxxxxx +``` + +For more information, see [manage-bde unlock][WINS-1] + +#### [:::image type="icon" source="images/controlpanel.svg"::: **Control Panel**](#tab/controlpanel) + +You can unlock the drive from the Control Panel or from Explorer. After opening the BitLocker Control Panel applet, select the **Unlock drive** option to begin the process. When prompted, enter the 48-digit recovery key. + +--- + [PREV-1]: /previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/ff829849(v=ws.11) [PS-1]: /powershell/module/bitlocker +[PS-2]: /powershell/module/bitlocker/unlock-bitlocker?view=windowsserver2022-ps +[WINS-1]: /windows-server/administration/windows-commands/manage-bde-unlock \ No newline at end of file diff --git a/windows/security/operating-system-security/data-protection/bitlocker/recovery-process.md b/windows/security/operating-system-security/data-protection/bitlocker/recovery-process.md index aee50a307d..7f22206332 100644 --- a/windows/security/operating-system-security/data-protection/bitlocker/recovery-process.md +++ b/windows/security/operating-system-security/data-protection/bitlocker/recovery-process.md @@ -2,7 +2,7 @@ title: BitLocker recovery process description: Learn how to obtain BitLocker recovery information for Microsoft Entra joined, Microsoft Entra hybrid joined, and Active Directory joined devices, and how to restore access to a locked drive. ms.topic: how-to -ms.date: 06/18/2024 +ms.date: 07/08/2024 --- # BitLocker recovery process @@ -26,6 +26,13 @@ A recovery key can't be stored in any of the following locations: - The root directory of a nonremovable drive - An encrypted volume +### Self-recovery with recovery password + +If you have access to the recovery key, enter the 48-digits in the preboot recovery screen. + +- If you are having issues entering the recovery password in the preboot recovery screen, or you can no longer boot your device, you can connect the drive to another device as a secondary drive. For more information, see [Unlock a drive](operations-guide.md#unlock-a-drive) +- If unlocking with recovery password doesn't work you can use the [BitLocker Repair tool](#bitlocker-repair-tool) to regain access yo your drive + ### Self-recovery in Microsoft Entra ID If BitLocker recovery keys are stored in Microsoft Entra ID, users can access them using the following URL: https://myaccount.microsoft.com. From the **Devices** tab, users can select a Windows device that they own, and select the option **View BitLocker Keys**. From ec883f83d413dcaa2dbf22f87bc37302bc06e885 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 8 Jul 2024 11:34:17 -0400 Subject: [PATCH 04/41] removes version --- .../data-protection/bitlocker/operations-guide.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/operating-system-security/data-protection/bitlocker/operations-guide.md b/windows/security/operating-system-security/data-protection/bitlocker/operations-guide.md index c41b4ab0cb..8ac5689f57 100644 --- a/windows/security/operating-system-security/data-protection/bitlocker/operations-guide.md +++ b/windows/security/operating-system-security/data-protection/bitlocker/operations-guide.md @@ -642,5 +642,5 @@ You can unlock the drive from the Control Panel or from Explorer. After opening [PREV-1]: /previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/ff829849(v=ws.11) [PS-1]: /powershell/module/bitlocker -[PS-2]: /powershell/module/bitlocker/unlock-bitlocker?view=windowsserver2022-ps +[PS-2]: /powershell/module/bitlocker/unlock-bitlocker [WINS-1]: /windows-server/administration/windows-commands/manage-bde-unlock \ No newline at end of file From da3a1a997e63512a4ff64d4a11e1707af080324d Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 8 Jul 2024 11:42:35 -0400 Subject: [PATCH 05/41] chore: Update BitLocker unlock instructions in operations guide --- .../data-protection/bitlocker/operations-guide.md | 2 +- .../data-protection/bitlocker/recovery-process.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/operating-system-security/data-protection/bitlocker/operations-guide.md b/windows/security/operating-system-security/data-protection/bitlocker/operations-guide.md index 8ac5689f57..7bf6e12c5a 100644 --- a/windows/security/operating-system-security/data-protection/bitlocker/operations-guide.md +++ b/windows/security/operating-system-security/data-protection/bitlocker/operations-guide.md @@ -612,7 +612,7 @@ Once decryption is complete, the drive updates its status in the Control Panel a ## Unlock a drive -If connect a drive as a secondary drive to a device, and you have your BitLocker recovery key, you can unlock a BitLocker-enabled drive by using the following instructions. +If you connect a drive as a secondary drive to a device, and you have your BitLocker recovery key, you can unlock a BitLocker-enabled drive by using the following instructions. In the next example, the `D` drive is the one to unlock. Select the option that best suits your needs. diff --git a/windows/security/operating-system-security/data-protection/bitlocker/recovery-process.md b/windows/security/operating-system-security/data-protection/bitlocker/recovery-process.md index 7f22206332..d6e0f76716 100644 --- a/windows/security/operating-system-security/data-protection/bitlocker/recovery-process.md +++ b/windows/security/operating-system-security/data-protection/bitlocker/recovery-process.md @@ -30,7 +30,7 @@ A recovery key can't be stored in any of the following locations: If you have access to the recovery key, enter the 48-digits in the preboot recovery screen. -- If you are having issues entering the recovery password in the preboot recovery screen, or you can no longer boot your device, you can connect the drive to another device as a secondary drive. For more information, see [Unlock a drive](operations-guide.md#unlock-a-drive) +- If you are having issues entering the recovery password in the preboot recovery screen, or you can no longer boot your device, you can connect the drive to another device as a secondary drive. For more information about the unlock process, see [Unlock a drive](operations-guide.md#unlock-a-drive) - If unlocking with recovery password doesn't work you can use the [BitLocker Repair tool](#bitlocker-repair-tool) to regain access yo your drive ### Self-recovery in Microsoft Entra ID From 7bc18d74d30e194e8108c7478d9a21c56ae26346 Mon Sep 17 00:00:00 2001 From: Stacyrch140 <102548089+Stacyrch140@users.noreply.github.com> Date: Mon, 8 Jul 2024 12:15:23 -0400 Subject: [PATCH 06/41] pencil edit --- .../hello-for-business/deploy/hybrid-cert-trust-enroll.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-enroll.md b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-enroll.md index 046cff4a4d..e2e4402d37 100644 --- a/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-enroll.md +++ b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-enroll.md @@ -37,7 +37,7 @@ Use the following instructions to configure your devices using either Microsoft Windows Hello for Business provisioning performs the initial enrollment of the Windows Hello for Business authentication certificate. This certificate expires based on the duration configured in the Windows Hello for Business *authentication certificate* template. -The process requires no user interaction, provided the user signs-in using Windows Hello for Business. The certificate is renewed in the background before it expires. +The process requires no user interaction, provided the user signs in using Windows Hello for Business. The certificate is renewed in the background before it expires. [!INCLUDE [gpo-settings-1](../../../../../includes/configure/gpo-settings-1.md)] From eb01cee7d91bc2c2ab2aa630b1e3cf38e49d5a2c Mon Sep 17 00:00:00 2001 From: Stacyrch140 <102548089+Stacyrch140@users.noreply.github.com> Date: Mon, 8 Jul 2024 12:16:15 -0400 Subject: [PATCH 07/41] pencil edit --- .../hello-for-business/deploy/on-premises-cert-trust-enroll.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-enroll.md b/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-enroll.md index 8c1de9a2d0..3a9200db54 100644 --- a/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-enroll.md +++ b/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-enroll.md @@ -37,7 +37,7 @@ Follow the instructions below to configure your devices using either Microsoft I Windows Hello for Business provisioning performs the initial enrollment of the Windows Hello for Business authentication certificate. This certificate expires based on the duration configured in the Windows Hello for Business *authentication certificate* template. -The process requires no user interaction, provided the user signs-in using Windows Hello for Business. The certificate is renewed in the background before it expires. +The process requires no user interaction, provided the user signs in using Windows Hello for Business. The certificate is renewed in the background before it expires. [!INCLUDE [gpo-settings-1](../../../../../includes/configure/gpo-settings-1.md)] From 3e827c1506baf1e927fb0215d509e0f491333f31 Mon Sep 17 00:00:00 2001 From: Stacyrch140 <102548089+Stacyrch140@users.noreply.github.com> Date: Mon, 8 Jul 2024 12:17:13 -0400 Subject: [PATCH 08/41] pencil edit --- windows/security/identity-protection/hello-for-business/faq.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/faq.yml b/windows/security/identity-protection/hello-for-business/faq.yml index 98723b63f6..fb596103e4 100644 --- a/windows/security/identity-protection/hello-for-business/faq.yml +++ b/windows/security/identity-protection/hello-for-business/faq.yml @@ -213,7 +213,7 @@ sections: - question: Do I need line of sight to a domain controller to use Windows Hello for Business cloud Kerberos trust? answer: | Windows Hello for Business cloud Kerberos trust requires line of sight to a domain controller when: - - a user signs-in for the first time or unlocks with Windows Hello for Business after provisioning + - a user signs in for the first time or unlocks with Windows Hello for Business after provisioning - attempting to access on-premises resources secured by Active Directory - question: Can I use RDP/VDI with Windows Hello for Business cloud Kerberos trust? answer: | From f22ebc4fe2d020739414ea7e7fdfcbf6b0964159 Mon Sep 17 00:00:00 2001 From: Stacyrch140 <102548089+Stacyrch140@users.noreply.github.com> Date: Mon, 8 Jul 2024 12:17:58 -0400 Subject: [PATCH 09/41] pencil edit --- .../hello-for-business/hello-errors-during-pin-creation.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md b/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md index 0e89afb281..ef8e864841 100644 --- a/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md +++ b/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md @@ -53,7 +53,7 @@ If the error occurs again, check the error code against the following table to s | 0x801C03EA | Server failed to authorize user or device. | Check if the token is valid and user has permission to register Windows Hello for Business keys. | | 0x801C03EB | Server response http status isn't valid | Sign out and then sign in again. | | 0x801C03EC | Unhandled exception from server. | sign out and then sign in again. | -| 0x801C03ED | Multi-factor authentication is required for a 'ProvisionKey' operation, but wasn't performed.

-or-

Token wasn't found in the Authorization header.

-or-

Failed to read one or more objects.

-or-

The request sent to the server was invalid.

-or-

User doesn't have permissions to join to Microsoft Entra ID. | Sign out and then sign in again. If that doesn't resolve the issue, unjoin the device from Mcirosoft Entra ID and rejoin.
Allow user(s) to join to Microsoft Entra ID under Microsoft Entra Device settings. | +| 0x801C03ED | Multi-factor authentication is required for a 'ProvisionKey' operation, but wasn't performed.

-or-

Token wasn't found in the Authorization header.

-or-

Failed to read one or more objects.

-or-

The request sent to the server was invalid.

-or-

User doesn't have permissions to join to Microsoft Entra ID. | Sign out and then sign in again. If that doesn't resolve the issue, unjoin the device from Microsoft Entra ID and rejoin.
Allow user(s) to join to Microsoft Entra ID under Microsoft Entra Device settings. | | 0x801C03EE | Attestation failed. | Sign out and then sign in again. | | 0x801C03EF | The AIK certificate is no longer valid. | Sign out and then sign in again. | | 0x801C03F2 | Windows Hello key registration failed. | ERROR_BAD_DIRECTORY_REQUEST. Another object with the same value for property proxyAddresses already exists. To resolve the issue, refer to [Duplicate Attributes Prevent Dirsync](/office365/troubleshoot/administration/duplicate-attributes-prevent-dirsync). Also, if no sync conflict exists, please verify that the "Mail/Email address" in Microsoft Entra ID and the Primary SMTP address are the same in the proxy address. | From 6b576d95499cd639fd27920bea2a15503f1b695d Mon Sep 17 00:00:00 2001 From: "Vinay Pamnani (from Dev Box)" Date: Mon, 8 Jul 2024 11:13:59 -0600 Subject: [PATCH 10/41] MDM Freshness --- ...e-active-directory-integration-with-mdm.md | 44 ++++++------------- ...omatic-mdm-enrollment-in-the-new-portal.md | 2 +- ...ollment-using-windows-provisioning-tool.md | 12 ++--- ...ficate-authentication-device-enrollment.md | 2 +- .../certificate-renewal-windows-mdm.md | 8 ++-- windows/client-management/config-lock.md | 4 +- .../declared-configuration-extensibility.md | 6 +-- .../declared-configuration.md | 2 +- .../device-update-management.md | 8 ++-- .../disconnecting-from-mdm-unenrollment.md | 10 ++--- .../enable-admx-backed-policies-in-mdm.md | 2 +- ...device-automatically-using-group-policy.md | 4 +- .../enterprise-app-management.md | 12 ++--- .../esim-enterprise-management.md | 4 +- ...erated-authentication-device-enrollment.md | 14 +++--- ...rver-side-mobile-application-management.md | 6 +-- windows/client-management/index.yml | 2 +- ...-in-your-organization-modern-management.md | 12 ++--- windows/client-management/mdm-collect-logs.md | 4 +- .../mdm-diagnose-enrollment.md | 2 +- .../mdm-enrollment-of-windows-devices.md | 6 +-- windows/client-management/mdm-known-issues.md | 10 ++--- windows/client-management/mdm-overview.md | 4 +- .../mobile-device-enrollment.md | 8 ++-- ...ew-in-windows-mdm-enrollment-management.md | 2 +- .../oma-dm-protocol-support.md | 2 +- ...remise-authentication-device-enrollment.md | 2 +- .../push-notification-windows-mdm.md | 2 +- .../server-requirements-windows-mdm.md | 6 +-- .../structure-of-oma-dm-provisioning-files.md | 2 +- .../understanding-admx-backed-policies.md | 2 +- ...-scripting-with-the-wmi-bridge-provider.md | 2 +- ...and-centennial-app-policy-configuration.md | 2 +- .../windows-mdm-enterprise-settings.md | 14 +++--- .../wmi-providers-supported-in-windows.md | 2 +- 35 files changed, 100 insertions(+), 126 deletions(-) diff --git a/windows/client-management/azure-active-directory-integration-with-mdm.md b/windows/client-management/azure-active-directory-integration-with-mdm.md index 27c5fb235c..eefc2151ab 100644 --- a/windows/client-management/azure-active-directory-integration-with-mdm.md +++ b/windows/client-management/azure-active-directory-integration-with-mdm.md @@ -5,18 +5,18 @@ ms.topic: conceptual ms.collection: - highpri - tier2 -ms.date: 08/10/2023 +ms.date: 07/08/2024 --- # Microsoft Entra integration with MDM -Microsoft Entra ID is the world's largest enterprise cloud identity management service. It's used by organizations to access Microsoft 365 and business applications from Microsoft and third-party software as a service (SaaS) vendors. Many of the rich Windows experiences for organizational users (such as store access or OS state roaming) use Microsoft Entra ID as the underlying identity infrastructure. Windows integrates with Microsoft Entra ID, allowing devices to be registered in Microsoft Entra ID and enrolled into MDM in an integrated flow. +Microsoft Entra ID is the world's largest enterprise cloud identity management service. It's used by organizations to access Microsoft 365 and business applications from Microsoft and third-party software as a service (SaaS) vendors. Many of the rich Windows experiences for organizational users (such as store access or OS state roaming) use Microsoft Entra ID as the underlying identity infrastructure. Windows integrates with Microsoft Entra ID, allowing devices to be registered in Microsoft Entra ID and enrolled into Mobile Device Management (MDM) in an integrated flow. Once a device is enrolled in MDM, the MDM: - Can enforce compliance with organization policies, add or remove apps, and more. - Can report a device's compliance in Microsoft Entra ID. -- Microsoft Entra ID can allow access to organization resources or applications secured by Microsoft Entra ID to devices that comply with policies. +- Can allow access to organization resources or applications secured by Microsoft Entra ID to devices that comply with policies. To support these rich experiences with their MDM product, MDM vendors can integrate with Microsoft Entra ID. @@ -24,23 +24,21 @@ To support these rich experiences with their MDM product, MDM vendors can integr There are several ways to connect your devices to Microsoft Entra ID: -- [Join device to Microsoft Entra ID](/azure/active-directory/devices/concept-azure-ad-join) -- [Join device to on-premises AD and Microsoft Entra ID](/azure/active-directory/devices/concept-azure-ad-join-hybrid) -- [Add a Microsoft work account to Windows](/azure/active-directory/devices/concept-azure-ad-register) +- [Join device to Microsoft Entra ID](/entra/identity/devices/concept-directory-join) +- [Join device to on-premises AD and Microsoft Entra ID](/entra/identity/devices/concept-hybrid-join) +- [Add a Microsoft work account to Windows](/entra/identity/devices/concept-device-registration) In each scenario, Microsoft Entra authenticates the user and the device. It provides a verified unique device identifier that can be used for MDM enrollment. The enrollment flow provides an opportunity for the MDM service to render its own UI, using a web view. MDM vendors should use the UI to render the Terms of Use (TOU), which can be different for company-owned and bring-your-own-device (BYOD) devices. MDM vendors can also use the web view to render more UI elements, such as asking for a one-time PIN. In Windows 10, the web view during the out-of-the-box scenario is displayed as full-screen by default, providing MDM vendors with the capability to create a seamless edge-to-edge user experience. However, in Windows 11 the web view is rendered within an iframe. It's important that MDM vendors who integrate with Microsoft Entra ID respect the Windows design guidelines. This step includes using a responsive web design and respecting the Windows accessibility guidelines. For example, include the forward and back buttons that are properly wired to the navigation logic. More details are provided later in this article. -For Microsoft Entra enrollment to work for an Active Directory Federated Services (AD FS) backed Microsoft Entra account, you must enable password authentication for the intranet on the ADFS service. For more information, see [Configure Azure MFA as authentication provider with AD FS](/windows-server/identity/ad-fs/operations/configure-ad-fs-and-azure-mfa). +For Microsoft Entra enrollment to work for an Active Directory Federated Services (AD FS) backed Microsoft Entra account, you must enable password authentication for the intranet on the ADFS service. For more information, see [Configure Microsoft Entra multifactor authentication as authentication provider with AD FS](/windows-server/identity/ad-fs/operations/configure-ad-fs-and-azure-mfa). Once a user has a Microsoft Entra account added to Windows and enrolled in MDM, the enrollment can be managed through **Settings** > **Accounts** > **Access work or school**. Device management of either Microsoft Entra join for organization scenarios or BYOD scenarios is similar. > [!NOTE] > Users can't remove the device enrollment through the **Access work or school** user interface because management is tied to the Microsoft Entra ID or work account. - - ### MDM endpoints involved in Microsoft Entra integrated enrollment Microsoft Entra MDM enrollment is a two-step process: @@ -64,17 +62,15 @@ To support Microsoft Entra enrollment, MDM vendors must host and expose a **Term The MDM is expected to use this information about the device (Device ID) when reporting device compliance back to Microsoft Entra ID using the [Microsoft Graph API](/azure/active-directory/develop/active-directory-graph-api). A sample for reporting device compliance is provided later in this article. - - ## Make MDM a reliable party of Microsoft Entra ID To participate in the integrated enrollment flow outlined in the previous section, the MDM must consume access tokens issued by Microsoft Entra ID. To report compliance with Microsoft Entra ID, the MDM must authenticate itself to Microsoft Entra ID and obtain authorization in the form of an access token that allows it to invoke the [Microsoft Graph API](/azure/active-directory/develop/active-directory-graph-api). ### Cloud-based MDM -A cloud-based MDM is a SaaS application that provides device management capabilities in the cloud. It's a multi-tenant application. This application is registered with Microsoft Entra ID in the home tenant of the MDM vendor. When an IT admin decides to use this MDM solution, an instance of this application is made visible in the tenant of the customer. +A cloud-based MDM is a SaaS application that provides device management capabilities in the cloud. It's a multitenant application. This application is registered with Microsoft Entra ID in the home tenant of the MDM vendor. When an IT admin decides to use this MDM solution, an instance of this application is made visible in the tenant of the customer. -The MDM vendor must first register the application in their home tenant and mark it as a multi-tenant application. For more information about how to add multi-tenant applications to Microsoft Entra ID, see the [Integrate an app that authenticates users and calls Microsoft Graph using the multi-tenant integration pattern (SaaS)](https://go.microsoft.com/fwlink/p/?LinkId=613661) code sample on GitHub. +The MDM vendor must first register the application in their home tenant and mark it as a multitenant application. For more information about how to add multitenant applications to Microsoft Entra ID, see the [Integrate an app that authenticates users and calls Microsoft Graph using the multitenant integration pattern (SaaS)](https://go.microsoft.com/fwlink/p/?LinkId=613661) code sample on GitHub. > [!NOTE] > For the MDM provider, if you don't have an existing Microsoft Entra tenant with a Microsoft Entra subscription that you manage, follow these step-by-step guides: @@ -82,7 +78,7 @@ The MDM vendor must first register the application in their home tenant and mark > - [Quickstart: Create a new tenant in Microsoft Entra ID](/azure/active-directory/fundamentals/active-directory-access-create-new-tenant) to set up a tenant. > - [Associate or add an Azure subscription to your Microsoft Entra tenant](/azure/active-directory/fundamentals/active-directory-how-subscriptions-associated-directory) to add a subscription, and manage it via the Azure Portal. -The MDM application uses keys to request access tokens from Microsoft Entra ID. These keys are managed within the tenant of the MDM provider and not visible to individual customers. The same key is used by the multi-tenant MDM application to authenticate itself with Microsoft Entra ID, in the customer tenant where the managed device belongs. +The MDM application uses keys to request access tokens from Microsoft Entra ID. These keys are managed within the tenant of the MDM provider and not visible to individual customers. The same key is used by the multitenant MDM application to authenticate itself with Microsoft Entra ID, in the customer tenant where the managed device belongs. > [!NOTE] > All MDM apps must implement Microsoft Entra v2 tokens before we certify that integration works. Due to changes in the Microsoft Entra app platform, using Microsoft Entra v2 tokens is a hard requirement. For more information, see [Microsoft identity platform access tokens](/azure/active-directory/develop/access-tokens#token-formats). @@ -107,8 +103,6 @@ For cloud-based MDM, you can roll over the application keys without requiring a For the on-premises MDM, the Microsoft Entra authentication keys are within the customer tenant and the customer's administrator must roll over the keys. To improve security, provide guidance to customers about rolling over and protecting the keys. - - ## Publish your MDM app to Microsoft Entra app gallery IT administrators use the Microsoft Entra app gallery to add an MDM for their organization to use. The app gallery is a rich store with over 2400 SaaS applications that are integrated with Microsoft Entra ID. @@ -124,7 +118,7 @@ The following table shows the required information to create an entry in the Mic | Item | Description | |---------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| **Application ID** | The client ID of your MDM app that is configured within your tenant. This ID is the unique identifier for your multi-tenant app. | +| **Application ID** | The client ID of your MDM app that is configured within your tenant. This ID is the unique identifier for your multitenant app. | | **Publisher** | A string that identifies the publisher of the app. | | **Application URL** | A URL to the landing page of your app where your administrators can get more information about the MDM app and contains a link to the landing page of your app. This URL isn't used for the actual enrollment. | | **Description** | A brief description of your MDM app, which must be under 255 characters. | @@ -191,7 +185,7 @@ The following claims are expected in the access token passed by Windows to the T |-----------|----------------------------------------------------------------------------------------------| | Object ID | Identifier of the user object corresponding to the authenticated user. | | UPN | A claim containing the user principal name (UPN) of the authenticated user. | -| TID | A claim representing the tenant ID of the tenant. In the example above, it's Fabrikam. | +| TID | A claim representing the tenant ID of the tenant. In the previous example, it's Fabrikam. | | Resource | A sanitized URL representing the MDM application. Example: `https://fabrikam.contosomdm.com` | > [!NOTE] @@ -206,7 +200,7 @@ https://fabrikam.contosomdm.com/TermsOfUse?redirect_uri=ms-appx-web://ContosoMdm Authorization: Bearer eyJ0eXAiOi ``` -The MDM is expected to validate the signature of the access token to ensure it is issued by Microsoft Entra ID and that the recipient is appropriate. +The MDM is expected to validate the signature of the access token to ensure it's issued by Microsoft Entra ID and that the recipient is appropriate. ### Terms of Use content @@ -260,8 +254,6 @@ The following table shows the error codes. | Microsoft Entra token validation failed | 302 | unauthorized_client | unauthorized_client | | internal service error | 302 | server_error | internal service error | - - ## Enrollment protocol with Microsoft Entra ID With Azure integrated MDM enrollment, there's no discovery phase and the discovery URL is directly passed down to the system from Azure. The following table shows the comparison between the traditional and Azure enrollments. @@ -284,8 +276,6 @@ With Azure integrated MDM enrollment, there's no discovery phase and the discove |EnrollmentData Terms of Use binary blob as AdditionalContext for EnrollmentServiceURL|Not supported|Supported|Supported| |CSPs accessible during enrollment|Windows 10 support:
- DMClient
- CertificateStore
- RootCATrustedCertificates
- ClientCertificateInstall
- EnterpriseModernAppManagement
- PassportForWork
- Policy
- w7 APPLICATION||| - - ## Management protocol with Microsoft Entra ID There are two different MDM enrollment types that integrate with Microsoft Entra ID, and use Microsoft Entra user and device identities. Depending on the enrollment type, the MDM service may need to manage a single user or multiple users. @@ -318,8 +308,6 @@ There are two different MDM enrollment types that integrate with Microsoft Entra - Use the JWT Token Handler extension for WIF to validate the contents of the access token and extract claims required for use. For more information, see [JwtSecurityTokenHandler Class](/dotnet/api/system.identitymodel.tokens.jwt.jwtsecuritytokenhandler). - Refer to the Microsoft Entra authentication code samples to get a sample for working with access tokens. For an example, see [NativeClient-DotNet](https://go.microsoft.com/fwlink/p/?LinkId=613667). - - ## Device Alert 1224 for Microsoft Entra user token An alert is sent when the DM session starts and there's a Microsoft Entra user logged in. The alert is sent in OMA DM package #1. Here's an example: @@ -372,15 +360,13 @@ Here's an example. ``` - - ## Report device compliance to Microsoft Entra ID Once a device is enrolled with the MDM for management, organization policies configured by the IT administrator are enforced on the device. MDM evaluates the device compliance with configured policies and then reports it to Microsoft Entra ID. This section covers the Graph API call you can use to report a device compliance status to Microsoft Entra ID. For a sample that illustrates how an MDM can obtain an access token using OAuth 2.0 client\_credentials grant type, see [Daemon\_CertificateCredential-DotNet](https://go.microsoft.com/fwlink/p/?LinkId=613822). -- **Cloud-based MDM** - If your product is a cloud-based multi-tenant MDM service, you have a single key configured for your service within your tenant. To obtain authorization, use this key to authenticate the MDM service with Microsoft Entra ID. +- **Cloud-based MDM** - If your product is a cloud-based multitenant MDM service, you have a single key configured for your service within your tenant. To obtain authorization, use this key to authenticate the MDM service with Microsoft Entra ID. - **On-premises MDM** - If your product is an on-premises MDM, customers must configure your product with the key used to authenticate with Microsoft Entra ID. This key configuration is because each on-premises instance of your MDM product has a different tenant-specific key. So, you may need to expose a configuration experience in your MDM product that enables administrators to specify the key to be used to authenticate with Microsoft Entra ID. ### Use Microsoft Graph API @@ -415,8 +401,6 @@ Response: - Success - HTTP 204 with No Content. - Failure/Error - HTTP 404 Not Found. This error may be returned if the specified device or tenant can't be found. - - ## Data loss during unenrollment from Microsoft Entra join When a user is enrolled into MDM through Microsoft Entra join and then disconnects the enrollment, there's no warning that the user will lose Windows Information Protection (WIP) data. The disconnection message doesn't indicate the loss of WIP data. diff --git a/windows/client-management/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md b/windows/client-management/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md index ab7c3e0a1c..aca40777f6 100644 --- a/windows/client-management/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md +++ b/windows/client-management/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md @@ -2,7 +2,7 @@ title: Automatic MDM enrollment in the Intune admin center description: Automatic MDM enrollment in the Intune admin center ms.topic: conceptual -ms.date: 08/10/2023 +ms.date: 07/08/2024 --- # Automatic MDM enrollment in the Intune admin center diff --git a/windows/client-management/bulk-enrollment-using-windows-provisioning-tool.md b/windows/client-management/bulk-enrollment-using-windows-provisioning-tool.md index d9938c6409..2b0ca2a334 100644 --- a/windows/client-management/bulk-enrollment-using-windows-provisioning-tool.md +++ b/windows/client-management/bulk-enrollment-using-windows-provisioning-tool.md @@ -1,13 +1,13 @@ --- title: Bulk enrollment -description: Bulk enrollment is an efficient way to set up a large number of devices to be managed by an MDM server without the need to reimage the devices. +description: Bulk enrollment is an efficient way to set up a large number of devices to manage by an MDM server without the need to reimage the devices. ms.topic: conceptual -ms.date: 08/10/2023 +ms.date: 07/08/2024 --- # Bulk enrollment using Windows Configuration Designer -Bulk enrollment is an efficient way to set up a large number of devices to be managed by an MDM server without the need to reimage the devices. You can use the [Provisioning CSP](mdm/provisioning-csp.md) for bulk enrollment, except for the Microsoft Entra join enrollment scenario. +Bulk enrollment is an efficient way to set up a large number of devices to manage by an MDM server without the need to reimage the devices. You can use the [Provisioning CSP](mdm/provisioning-csp.md) for bulk enrollment, except for the Microsoft Entra join enrollment scenario. ## Typical use cases @@ -68,7 +68,7 @@ Using the WCD, create a provisioning package using the enrollment information re ![bulk enrollment screenshot.](images/bulk-enrollment.png) 1. Configure the other settings, such as the Wi-Fi connections so that the device can join a network before joining MDM (for example, **Runtime settings** > **ConnectivityProfiles** > **WLANSetting**). -1. When you're done adding all the settings, on the **File** menu, select **Save**. +1. After adding all the settings, select **Save** on the **File** menu. 1. On the main menu, select **Export** > **Provisioning package**. ![icd menu for export.](images/bulk-enrollment2.png) @@ -120,7 +120,7 @@ Using the WCD, create a provisioning package using the enrollment information re For detailed descriptions of these settings, see [Provisioning CSP](mdm/provisioning-csp.md). 1. Configure the other settings, such as the Wi-Fi connection so that the device can join a network before joining MDM (for example, **Runtime settings** > **ConnectivityProfiles** > **WLANSetting**). -1. When you're done adding all the settings, on the **File** menu, select **Save**. +1. After adding all the settings, select **Save** on the **File** menu. 1. Export and build the package (steps 10-13 in previous section). 1. Apply the package to some test devices and verify that they work. For more information, see [Apply a provisioning package](#apply-a-provisioning-package). 1. Apply the package to your devices. @@ -142,7 +142,7 @@ Using the WCD, create a provisioning package using the enrollment information re - If the provisioning engine receives a failure from a CSP, it retries provisioning three times in a row. - If all immediate attempts fail, a delayed task is launched to try provisioning again later. It will retry four times at a decaying rate of 15 minutes -> 1 hr -> 4 hr -> "Next System Start". These attempts are run from the SYSTEM context. - It also retries the provisioning each time it's launched, if started from somewhere else as well. -- In addition, provisioning will be restarted in the SYSTEM context after a sign in and the [system has been idle](/windows/win32/taskschd/task-idle-conditions). +- In addition, provisioning will be restarted in the SYSTEM context after a sign in and the [system is idle](/windows/win32/taskschd/task-idle-conditions). ## Related articles diff --git a/windows/client-management/certificate-authentication-device-enrollment.md b/windows/client-management/certificate-authentication-device-enrollment.md index e53a80cc55..2cea712e44 100644 --- a/windows/client-management/certificate-authentication-device-enrollment.md +++ b/windows/client-management/certificate-authentication-device-enrollment.md @@ -2,7 +2,7 @@ title: Certificate authentication device enrollment description: This section provides an example of the mobile device enrollment protocol using certificate authentication policy. ms.topic: conceptual -ms.date: 08/10/2023 +ms.date: 07/08/2024 --- # Certificate authentication device enrollment diff --git a/windows/client-management/certificate-renewal-windows-mdm.md b/windows/client-management/certificate-renewal-windows-mdm.md index 573cbe71b2..66d42a4d90 100644 --- a/windows/client-management/certificate-renewal-windows-mdm.md +++ b/windows/client-management/certificate-renewal-windows-mdm.md @@ -2,7 +2,7 @@ title: Certificate Renewal description: Learn how to find all the resources that you need to provide continuous access to client certificates. ms.topic: conceptual -ms.date: 08/10/2023 +ms.date: 07/08/2024 --- # Certificate Renewal @@ -19,7 +19,7 @@ Windows supports automatic certificate renewal, also known as Renew On Behalf Of > [!NOTE] > Certificate renewal of the enrollment certificate through ROBO is only supported with Microsoft PKI. -Auto certificate renewal is the only supported MDM client certificate renewal method for the device that's enrolled using WAB authentication. Meaning, the AuthPolicy is set to Federated. It also means if the server supports WAB authentication, then the MDM certificate enrollment server MUST also support client TLS to renew the MDM client certificate. +Auto certificate renewal is the only supported MDM client certificate renewal method for a device enrolled using WAB authentication. Meaning, the AuthPolicy is set to Federated. It also means if the server supports WAB authentication, then the MDM certificate enrollment server MUST also support client TLS to renew the MDM client certificate. For Windows devices, during the MDM client certificate enrollment phase or during MDM management section, the enrollment server or MDM server could configure the device to support automatic MDM client certificate renewal using [CertificateStore CSP's](mdm/certificatestore-csp.md) ROBOSupport node under `CertificateStore/My/WSTEP/Renew` URL. @@ -89,7 +89,7 @@ In Windows, the renewal period can only be set during the MDM enrollment phase. For more information about the parameters, see the [CertificateStore configuration service provider](mdm/certificatestore-csp.md). -Unlike manual certificate renewal, the device doesn't perform an automatic MDM client certificate renewal if the certificate is already expired. To make sure the device has enough time to automatically renew, we recommend you set a renewal period a couple months (40-60 days) before the certificate expires. And, set the renewal retry interval to every few days, like every 4-5 days instead of every seven days (weekly). This change increases the chance that the device will try to connect at different days of the week. +Unlike manual certificate renewal, the device doesn't perform an automatic MDM client certificate renewal if the certificate is already expired. To make sure the device has enough time to automatically renew, we recommend you set a renewal period a couple months (40-60 days) before the certificate expires. And, set the renewal retry interval to every few days, like every 4-5 days instead of every seven days (weekly). This change increases the chance that the device tries to connect at different days of the week. ## Certificate renewal response @@ -99,7 +99,7 @@ When RequestType is set to Renew, the web service verifies the following (in add - The client's certificate is in the renewal period - The certificate is issued by the enrollment service - The requester is the same as the requester for initial enrollment -- For standard client's request, the client hasn't been blocked +- For standard client's request, the client isn't blocked After validation is completed, the web service retrieves the PKCS#10 content from the PKCS#7 BinarySecurityToken. The rest is the same as initial enrollment, except that the Provisioning XML only needs to have the new certificate issued by the CA. diff --git a/windows/client-management/config-lock.md b/windows/client-management/config-lock.md index 30b905a41d..f497c86712 100644 --- a/windows/client-management/config-lock.md +++ b/windows/client-management/config-lock.md @@ -2,7 +2,7 @@ title: Secured-core configuration lock description: A secured-core PC (SCPC) feature that prevents configuration drift from secured-core PC features caused by unintentional misconfiguration. ms.topic: conceptual -ms.date: 08/10/2023 +ms.date: 07/08/2024 appliesto: - βœ… Windows 11 --- @@ -63,7 +63,7 @@ The steps to turn on config lock using Microsoft Intune are as follows: Config lock is designed to ensure that a secured-core PC isn't unintentionally misconfigured. You keep the ability to enable or disable SCPC features, for example, firmware protection. You can make these changes with group policies or MDM services like Microsoft Intune. -:::image type="content" source="images/configlock-mem-firmwareprotect.png" alt-text="The Defender Firmware protection setting, with a description of Windows Defender System Guard protects your device from compromised firmware. The setting is set to Off."::: +:::image type="content" source="images/configlock-mem-firmwareprotect.png" alt-text="The Defender Firmware protection setting, with a description of System Guard protects your device from compromised firmware. The setting is set to Off."::: ## FAQ diff --git a/windows/client-management/declared-configuration-extensibility.md b/windows/client-management/declared-configuration-extensibility.md index 3121be77f0..7b1f9991f8 100644 --- a/windows/client-management/declared-configuration-extensibility.md +++ b/windows/client-management/declared-configuration-extensibility.md @@ -1,13 +1,13 @@ --- title: Declared configuration extensibility description: Learn more about declared configuration extensibility through native WMI providers. -ms.date: 09/26/2023 +ms.date: 07/08/2024 ms.topic: how-to --- # Declared configuration extensibility providers -The declared configuration enrollment, which supports the declared configuration client stack, offers extensibility through native WMI providers. This feature instantiates and interfaces with a Windows Management Instrumentation (WMI) provider that has implemented a management infrastructure (MI) interface. The interface must implement GetTargetResource, TestTargetResource, and SetTargetResource methods, and may implement any number of string properties. +The declared configuration enrollment, which supports the declared configuration client stack, offers extensibility through native WMI providers. This feature instantiates and interfaces with a Windows Management Instrumentation (WMI) provider that implements a management infrastructure (MI) interface. The interface must implement GetTargetResource, TestTargetResource, and SetTargetResource methods, and can implement any number of string properties. > [!NOTE] > Only string properties are currently supported by extensibility providers. @@ -51,7 +51,7 @@ uint32 SetTargetResource( To create a native WMI provider, follow the steps outlined in [How to implement an MI provider](/previous-versions/windows/desktop/wmi_v2/how-to-implement-an-mi-provider). These steps include how to generate the source code for an MI interface using the `Convert-MofToProvider.exe` tool to generate the DLL and prepare it for placement. -1. Create a MOF file that defines the schema for the desired state configuration resource including parameters and methods. This file includes the required parameters for the resource. +1. Create a Managed Object Format (MOF) file that defines the schema for the desired state configuration resource including parameters and methods. This file includes the required parameters for the resource. 2. Copy the schema MOF file along with any required files into the provider tools directory, for example: ProviderGenerationTool. 3. Edit the required files and include the correct file names and class names. 4. Invoke the provider generator tool to generate the provider's project files. diff --git a/windows/client-management/declared-configuration.md b/windows/client-management/declared-configuration.md index f655d1ae19..e12a89b7ca 100644 --- a/windows/client-management/declared-configuration.md +++ b/windows/client-management/declared-configuration.md @@ -1,7 +1,7 @@ --- title: Declared configuration protocol description: Learn more about using declared configuration protocol for desired state management of Windows devices. -ms.date: 09/26/2023 +ms.date: 07/08/2024 ms.topic: overview --- diff --git a/windows/client-management/device-update-management.md b/windows/client-management/device-update-management.md index c298893a3a..5f61783f99 100644 --- a/windows/client-management/device-update-management.md +++ b/windows/client-management/device-update-management.md @@ -2,7 +2,7 @@ title: Mobile device management MDM for device updates description: Windows provides several APIs to help mobile device management (MDM) solutions manage updates. Learn how to use these APIs to implement update management. ms.topic: conceptual -ms.date: 08/10/2023 +ms.date: 07/08/2024 ms.collection: - highpri - tier2 @@ -25,7 +25,7 @@ In particular, Windows provides APIs to enable MDMs to: - Enter a per-device update approval list. The list makes sure devices only install updates that are approved and tested. - Approve end-user license agreements (EULAs) for the end user so update deployment can be automated even for updates with EULAs. -This article provides independent software vendors (ISV) with the information they need to implement update management in Windows. For more information, see [Policy CSP - Update](mdm/policy-csp-update.md). +This article provides independent software publishers (ISV) with the information they need to implement update management in Windows. For more information, see [Policy CSP - Update](mdm/policy-csp-update.md). > [!NOTE] > The OMA DM APIs for specifying update approvals and getting compliance status refer to updates by using an Update ID. The Update ID is a GUID that identifies a particular update. The MDM will want to show IT-friendly information about the update, instead of a raw GUID, including the update's title, description, KB, update type, like a security update or service pack. For more information, see [[MS-WSUSSS]: Windows Update Services: Server-Server Protocol](/openspecs/windows_protocols/ms-wsusss/f49f0c3e-a426-4b4b-b401-9aeb2892815c). @@ -88,7 +88,7 @@ This section describes a possible algorithm for using the server-server sync pro First some background: -- If you have a multi-tenant MDM, the update metadata can be kept in a shared partition, since it's common to all tenants. +- If you have a multitenant MDM, the update metadata can be kept in a shared partition, since it's common to all tenants. - A metadata sync service can then be implemented. The service periodically calls server-server sync to pull in metadata for the updates IT cares about. - The MDM component that uses OMA DM to control devices (described in the next section) should send the metadata sync service the list of needed updates it gets from each client, if those updates aren't already known to the device. @@ -130,7 +130,7 @@ The following screenshots of the administrator console show the list of update t ### SyncML example -Set auto update to notify and defer. +Set Microsoft AutoUpdate to notify and defer. ```xml diff --git a/windows/client-management/disconnecting-from-mdm-unenrollment.md b/windows/client-management/disconnecting-from-mdm-unenrollment.md index 612dd07651..cfc52d7c69 100644 --- a/windows/client-management/disconnecting-from-mdm-unenrollment.md +++ b/windows/client-management/disconnecting-from-mdm-unenrollment.md @@ -2,7 +2,7 @@ title: Disconnecting from the management infrastructure (unenrollment) description: Disconnecting is initiated either locally by the user using a phone or remotely by the IT admin using management server. ms.topic: conceptual -ms.date: 08/10/2023 +ms.date: 07/08/2024 --- # Disconnecting from the management infrastructure (unenrollment) @@ -22,14 +22,14 @@ During disconnection, the client executes the following tasks: In Windows, after the user confirms the account deletion command and before the account is deleted, the MDM client will notify to the MDM server that the account will be removed. This notification is a best-effort action as no retry is built in to ensure the notification is successfully sent to the device. -This action utilizes the OMA DM generic alert 1226 function to send a user an MDM unenrollment user alert to the MDM server after the device accepts the user unenrollment request, but before it deletes any enterprise data. The server should set the expectation that unenrollment may succeed or fail, and the server can check whether the device is unenrolled by either checking whether the device calls back at scheduled time or by sending a push notification to the device to see whether it responds back. If the server plans to send a push notification, it should allow for some delay to give the device the time to complete the unenrollment work. +This action utilizes the OMA DM generic alert 1226 function to send a user an MDM unenrollment user alert to the MDM server after the device accepts the user unenrollment request, but before it deletes any enterprise data. The server should set the expectation that unenrollment can succeed or fail, and the server can check whether the device is unenrolled by either checking whether the device calls back at scheduled time or by sending a push notification to the device to see whether it responds back. If the server plans to send a push notification, it should allow for some delay to give the device the time to complete the unenrollment work. > [!NOTE] > The user unenrollment is an OMA DM standard. For more information about the 1226 generic alert, see the OMA Device Management Protocol specification (OMA-TS-DM\_Protocol-V1\_2\_1-20080617-A), available from the [OMA website](https://www.openmobilealliance.org/release/DM/V1_1_2-20031209-A/). The vendor uses the Type attribute to specify what type of generic alert it is. For device initiated MDM unenrollment, the alert type is **com.microsoft:mdm.unenrollment.userrequest**. -After the user elects to unenroll, any active MDM OMA DM sessions are terminated. After that, the DM client starts a DM session, including a user unenroll generic alert in the first package that it sends to the server. +After the user elects to unenroll, any active MDM OMA DM sessions are terminated. After that, the DMClient starts a DM session, including a user unenroll generic alert in the first package that it sends to the server. The following sample shows an OMA DM first package that contains a generic alert message. For more information on WP OMA DM support, see the [OMA DM protocol support](oma-dm-protocol-support.md) article. @@ -107,15 +107,13 @@ You can only use the Work Access page to unenroll under the following conditions - Enrollment was done using bulk enrollment. - Enrollment was created using the Work Access page. - - ## Unenrollment from Microsoft Entra join When a user is enrolled into MDM through Microsoft Entra join and later, the enrollment disconnects, there's no warning that the user will lose Windows Information Protection (WIP) data. The disconnection message doesn't indicate the loss of WIP data. ![aadj unenerollment.](images/azure-ad-unenrollment.png) -During the process in which a device is enrolled into MDM through Microsoft Entra join and then remotely unenrolled, the device may get into a state where it must be reimaged. When devices are remotely unenrolled from MDM, the Microsoft Entra association is also removed. This safeguard is in place to avoid leaving the corporate devices in unmanaged state. +During the process in which a device is enrolled into MDM through Microsoft Entra join and then remotely unenrolled, the device can get into a state where it must be reimaged. When devices are remotely unenrolled from MDM, the Microsoft Entra association is also removed. This safeguard is in place to avoid leaving the corporate devices in unmanaged state. Before remotely unenrolling corporate devices, you must ensure that there is at least one admin user on the device that isn't part of Microsoft Entra ID, otherwise the device won't have any admin user after the operation. diff --git a/windows/client-management/enable-admx-backed-policies-in-mdm.md b/windows/client-management/enable-admx-backed-policies-in-mdm.md index 00618845b9..db0f36a085 100644 --- a/windows/client-management/enable-admx-backed-policies-in-mdm.md +++ b/windows/client-management/enable-admx-backed-policies-in-mdm.md @@ -3,7 +3,7 @@ title: Enable ADMX policies in MDM description: Use this step-by-step guide to configure a selected set of Group Policy administrative templates (ADMX policies) in Mobile Device Management (MDM). ms.topic: conceptual ms.localizationpriority: medium -ms.date: 08/10/2023 +ms.date: 07/08/2024 --- # Enable ADMX policies in MDM diff --git a/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md b/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md index f9ccd5cc0a..409c283821 100644 --- a/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md +++ b/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md @@ -2,7 +2,7 @@ title: Enroll a Windows device automatically using Group Policy description: Learn how to use a Group Policy to trigger autoenrollment to MDM for Active Directory (AD) domain-joined devices. ms.topic: conceptual -ms.date: 08/10/2023 +ms.date: 07/08/2024 ms.collection: - highpri - tier2 @@ -12,7 +12,7 @@ ms.collection: You can use a Group Policy to trigger autoenrollment to Mobile Device Management (MDM) for Active Directory (AD) domain-joined devices. -The enrollment into Intune is triggered by a group policy created on your local AD and happens without any user interaction. This cause-and-effect mechanism means you can automatically mass-enroll a large number of domain-joined corporate devices into Microsoft Intune. The enrollment process starts in the background once you sign in to the device with your Microsoft Entra account. +The group policy created on your local AD triggers enrollment into Intune without any user interaction. This cause-and-effect mechanism means you can automatically mass-enroll a large number of domain-joined corporate devices into Microsoft Intune. The enrollment process starts in the background once you sign in to the device with your Microsoft Entra account. **Requirements**: diff --git a/windows/client-management/enterprise-app-management.md b/windows/client-management/enterprise-app-management.md index b6e975a1c8..323376d673 100644 --- a/windows/client-management/enterprise-app-management.md +++ b/windows/client-management/enterprise-app-management.md @@ -2,7 +2,7 @@ title: Enterprise app management description: This article covers one of the key mobile device management (MDM) features for managing the lifecycle of apps across Windows devices. ms.topic: conceptual -ms.date: 08/10/2023 +ms.date: 07/08/2024 --- # Enterprise app management @@ -116,7 +116,7 @@ There are two basic types of apps you can deploy: - Store apps. - Enterprise signed apps. -To deploy enterprise signed apps, you must enable a setting on the device to allow trusted apps. The apps can be signed by a Microsoft approved root (such as Symantec), an enterprise deployed root, or apps that are self-signed. This section covers the steps to configure the device for non-store app deployment. +To deploy enterprise signed apps, you must enable a setting on the device to allow trusted apps. The apps can be signed by a Microsoft approved root (such as Symantec), an enterprise deployed root, or apps that are self-signed. This section covers the steps to configure the device for nonstore app deployment. ### Unlock the device for non-Store apps @@ -154,7 +154,7 @@ Here's an example: ### Unlock the device for developer mode -Development of apps on Windows devices no longer requires a special license. You can enable debugging and deployment of non-packaged apps using [ApplicationManagement/AllowDeveloperUnlock](mdm/policy-csp-applicationmanagement.md) policy in Policy CSP. +Development of apps on Windows devices no longer requires a special license. You can enable debugging and deployment of nonpackaged apps using [ApplicationManagement/AllowDeveloperUnlock](mdm/policy-csp-applicationmanagement.md) policy in Policy CSP. AllowDeveloperUnlock policy enables the development mode on the device. The AllowDeveloperUnlock isn't configured by default, which means only Microsoft Store apps can be installed. If the management server explicitly sets the value to off, the setting is disabled in the settings panel on the device. @@ -238,8 +238,8 @@ If you purchased an app from the Store for Business, the app license must be dep In the SyncML, you need to specify the following information in the `Exec` command: -- License ID - This ID is specified in the LocURI. The License ID for the offline license is referred to as the "Content ID" in the license file. You can retrieve this information from the Base64 encoded license download from the Store for Business. -- License Content - This content is specified in the data section. The License Content is the Base64 encoded blob of the license. +- License ID - This ID is specified in the LocURI. The License ID for the offline license is referred to as the "Content ID" in the license file. You can retrieve this information from the Base 64 encoded license download from the Store for Business. +- License Content - This content is specified in the data section. The License Content is the Base 64 encoded blob of the license. Here's an example of an offline license installation. @@ -469,7 +469,7 @@ When an app installation is completed, a Windows notification is sent. You can a - NOT\_INSTALLED (0) - The node was added, but the execution wasn't completed. - INSTALLING (1) - Execution has started, but the deployment hasn't completed. If the deployment completes regardless of success, then this value is updated. - FAILED (2) - Installation failed. The details of the error can be found under LastError and LastErrorDescription. - - INSTALLED (3) - Once an install is successful this node is cleaned up. If the clean up action hasn't completed, then this state may briefly appear. + - INSTALLED (3) - Once an install is successful this node is cleaned up. If the clean-up action hasn't completed, then this state may briefly appear. - LastError - The last error reported by the app deployment server. - LastErrorDescription - Describes the last error reported by the app deployment server. - Status - An integer that indicates the progress of the app installation. In cases of an HTTPS location, this status shows the estimated download progress. Status isn't available for provisioning and only used for user-based installations. For provisioning, the value is always 0. diff --git a/windows/client-management/esim-enterprise-management.md b/windows/client-management/esim-enterprise-management.md index 970b5917af..2a28981591 100644 --- a/windows/client-management/esim-enterprise-management.md +++ b/windows/client-management/esim-enterprise-management.md @@ -3,7 +3,7 @@ title: eSIM Enterprise Management description: Learn how Mobile Device Management (MDM) Providers support the eSIM Profile Management Solution on Windows. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 08/10/2023 +ms.date: 07/08/2024 --- # How Mobile Device Management Providers support eSIM Management on Windows @@ -28,7 +28,7 @@ If you're a Mobile Device Management (MDM) Provider and want to support eSIM Man - Assess solution type that you would like to provide your customers - Batch/offline solution - IT Admin can manually import a flat file containing list of eSIM activation codes, and provision eSIM on LTE enabled devices. -- Operator doesn't have visibility over status of the eSIM profiles and device eSIM has been downloaded and installed to +- Operator doesn't have visibility over status of the eSIM profiles - Real-time solution - MDM automatically syncs with the Operator backend system for subscription pool and eSIM management, via SIM vendor solution component. IT Admin can view subscription pool and provision eSIM in real time. - Operator is notified of the status of each eSIM profile and has visibility on which devices are being used diff --git a/windows/client-management/federated-authentication-device-enrollment.md b/windows/client-management/federated-authentication-device-enrollment.md index ecb42e8160..32b2fef7ef 100644 --- a/windows/client-management/federated-authentication-device-enrollment.md +++ b/windows/client-management/federated-authentication-device-enrollment.md @@ -2,7 +2,7 @@ title: Federated authentication device enrollment description: This section provides an example of the mobile device enrollment protocol using federated authentication policy. ms.topic: conceptual -ms.date: 08/10/2023 +ms.date: 07/08/2024 --- # Federated authentication device enrollment @@ -122,7 +122,7 @@ The discovery response is in the XML format and includes the following fields: > [!NOTE] > The HTTP server response must not set Transfer-Encoding to Chunked; it must be sent as one message. -When authentication policy is set to be Federated, Web Authentication Broker (WAB) is used by the enrollment client to get a security token. The WAB start page URL is provided by the discovery service in the response message. The enrollment client calls the WAB API within the response message to start the WAB process. WAB pages are server hosted web pages. The server should build those pages to fit the device screen nicely and be as consistent as possible to other builds in the MDM enrollment UI. The opaque security token that is returned from WAB as an endpage is used by the enrollment client as the device security secret during the client certificate enrollment request call. +When authentication policy is set to be Federated, Web Authentication Broker (WAB) is used by the enrollment client to get a security token. The WAB start page URL is provided by the discovery service in the response message. The enrollment client calls the WAB API within the response message to start the WAB process. WAB pages are server hosted web pages. The server should build those pages to fit the device screen nicely and be as consistent as possible to other builds in the MDM enrollment UI. The opaque security token that is returned from WAB as an end page is used by the enrollment client as the device security secret during the client certificate enrollment request call. > [!NOTE] > Instead of relying on the user agent string that is passed during authentication to get information, such as the OS version, use the following guidance: @@ -183,7 +183,7 @@ Content-Length: 556 ``` -The server has to send a POST to a redirect URL of the form `ms-app://string` (the URL scheme is ms-app) as indicated in the POST method action. The security token value is the base64-encoded string `http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\#base64binary` contained in the `` EncodingType attribute. Windows does the binary encode when it sends it back to enrollment server, in the form its just HTML encoded. This string is opaque to the enrollment client; the client doesn't interpret the string. +The server has to send a POST to a redirect URL of the form `ms-app://string` (the URL scheme is ms-app) as indicated in the POST method action. The security token value is the base64-encoded string `http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\#base64binary` contained in the `` EncodingType attribute. Windows does the binary encode when it sends it back to enrollment server, in the form it's just HTML encoded. This string is opaque to the enrollment client; the client doesn't interpret the string. The following example shows a response received from the discovery web service that requires authentication via WAB. @@ -367,7 +367,7 @@ The following snippet shows the policy web service response. ## Enrollment web service -This web service implements the MS-WSTEP protocol. It processes the RequestSecurityToken (RST) message from the client, authenticates the client, requests the certificate from the CA, and returns it in the RequestSecurityTokenResponse (RSTR) to the client. Besides the issued certificate, the response also contains configurations needed to provision the DM client. +This web service implements the MS-WSTEP protocol. It processes the RequestSecurityToken (RST) message from the client, authenticates the client, requests the certificate from the CA, and returns it in the RequestSecurityTokenResponse (RSTR) to the client. Besides the issued certificate, the response also contains configurations needed to provision the DMClient. The RequestSecurityToken (RST) must have the user credential and a certificate request. The user credential in an RST SOAP envelope is the same as in GetPolicies, and can vary depending on whether the authentication policy is OnPremise or Federated. The BinarySecurityToken in an RST SOAP body contains a Base64-encoded PKCS\#10 certificate request, which is generated by the client based on the enrollment policy. The client could have requested an enrollment policy by using MS-XCEP before requesting a certificate using MS-WSTEP. If the PKCS\#10 certificate request is accepted by the certification authority (CA) (the key length, hashing algorithm, and so on, match the certificate template), the client can enroll successfully. @@ -471,15 +471,15 @@ Similar to the TokenType in the RST, the RSTR uses a custom ValueType in the Bin The provisioning XML contains: - The requested certificates (required) -- The DM client configuration (required) +- The DMClient configuration (required) -The client installs the client certificate, the enterprise root certificate, and intermediate CA certificate if there's one. The DM configuration includes the name and address of the DM server, which client certificate to use, and schedules when the DM client calls back to the server. +The client installs the client certificate, the enterprise root certificate, and intermediate CA certificate if there's one. The DM configuration includes the name and address of the DM server, which client certificate to use, and schedules when the DMClient calls back to the server. Enrollment provisioning XML should contain a maximum of one root certificate and one intermediate CA certificate that is needed to chain up the MDM client certificate. More root and intermediate CA certificates could be provisioned during an OMA DM session. When root and intermediate CA certificates are being provisioned, the supported CSP node path is: CertificateStore/Root/System for root certificate provisioning, CertificateStore/My/User for intermediate CA certificate provisioning. -Here's a sample RSTR message and a sample of OMA client provisioning XML within RSTR. For more information about the configuration service providers (CSPs) used in provisioning XML, see the Enterprise settings, policies and app management section. +Here's a sample RSTR message and a sample of OMA client provisioning XML within RSTR. For more information about the configuration service providers (CSPs) used in provisioning XML, see the Enterprise settings, policies, and app management section. The following example shows the enrollment web service response. diff --git a/windows/client-management/implement-server-side-mobile-application-management.md b/windows/client-management/implement-server-side-mobile-application-management.md index e9c0ab5ecc..6d2acde09e 100644 --- a/windows/client-management/implement-server-side-mobile-application-management.md +++ b/windows/client-management/implement-server-side-mobile-application-management.md @@ -2,7 +2,7 @@ title: Support for Windows Information Protection (WIP) on Windows description: Learn about implementing the Windows version of Windows Information Protection (WIP), which is a lightweight solution for managing company data access and security on personal devices. ms.topic: conceptual -ms.date: 08/10/2023 +ms.date: 07/08/2024 --- # Support for Windows Information Protection (WIP) on Windows @@ -11,8 +11,6 @@ Windows Information Protection (WIP) is a lightweight solution for managing comp [!INCLUDE [Deprecate Windows Information Protection](../security/information-protection/windows-information-protection/includes/wip-deprecation.md)] - - ## Integration with Microsoft Entra ID WIP is integrated with Microsoft Entra identity service. The WIP service supports Microsoft Entra integrated authentication for the user and the device during enrollment and the downloading of WIP policies. WIP integration with Microsoft Entra ID is similar to mobile device management (MDM) integration. See [Microsoft Entra integration with MDM](azure-active-directory-integration-with-mdm.md). @@ -78,7 +76,7 @@ Since the [Poll](mdm/dmclient-csp.md#deviceproviderprovideridpoll) node isn't pr ## Supported CSPs -WIP supports the following configuration service providers (CSPs). All other CSPs are blocked. Note the list may change later based on customer feedback: +WIP supports the following configuration service providers (CSPs). All other CSPs are blocked. Note the list can change later based on customer feedback: - [AppLocker CSP](mdm/applocker-csp.md) for configuration of Windows Information Protection enterprise allowed apps. - [ClientCertificateInstall CSP](mdm/clientcertificateinstall-csp.md) for installing VPN and Wi-Fi certs. diff --git a/windows/client-management/index.yml b/windows/client-management/index.yml index 860eb04bfe..184e34da03 100644 --- a/windows/client-management/index.yml +++ b/windows/client-management/index.yml @@ -13,7 +13,7 @@ metadata: author: vinaypamnani-msft ms.author: vinpa manager: aaroncz - ms.date: 01/18/2024 + ms.date: 07/08/2024 localization_priority: medium # linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | tutorial | video | whats-new diff --git a/windows/client-management/manage-windows-10-in-your-organization-modern-management.md b/windows/client-management/manage-windows-10-in-your-organization-modern-management.md index cc6af7d11f..a43167be49 100644 --- a/windows/client-management/manage-windows-10-in-your-organization-modern-management.md +++ b/windows/client-management/manage-windows-10-in-your-organization-modern-management.md @@ -2,13 +2,13 @@ title: Manage Windows devices in your organization - transitioning to modern management description: This article offers strategies for deploying and managing Windows devices, including deploying Windows in a mixed environment. ms.localizationpriority: medium -ms.date: 08/10/2023 +ms.date: 07/08/2024 ms.topic: conceptual --- # Manage Windows devices in your organization - transitioning to modern management -Use of personal devices for work, and employees working outside the office, may be changing how your organization manages devices. Certain parts of your organization might require deep, granular control over devices, while other parts might seek lighter, scenario-based management that empowers the modern workforce. Windows offers the flexibility to respond to these changing requirements, and can easily be deployed in a mixed environment. You can shift the percentage of Windows devices gradually, following the normal upgrade schedules used in your organization. +Use of personal devices for work, and users working outside the office, may be changing how your organization manages devices. Certain parts of your organization might require deep, granular control over devices, while other parts might seek lighter, scenario-based management that empowers the modern workforce. Windows offers the flexibility to respond to these changing requirements, and can easily be deployed in a mixed environment. You can shift the percentage of Windows devices gradually, following the normal upgrade schedules used in your organization. Your organization can support various operating systems across a wide range of device types, and manage them through a common set of tools such as Microsoft Configuration Manager, Microsoft Intune, or other third-party products. This "managed diversity" enables you to empower your users to benefit from the productivity enhancements available on their new Windows devices (including rich touch and ink support), while still maintaining your standards for security and manageability. It can help you and your organization benefit from Windows faster. @@ -45,13 +45,13 @@ You can use Windows and services like [Microsoft Entra ID](/azure/active-directo You can envision user and device management as falling into these two categories: -- **Corporate (CYOD) or personal (BYOD) devices used by mobile users for SaaS apps such as Office 365.** With Windows, your employees can self-provision their devices: +- **Corporate (CYOD) or personal (BYOD) devices used by mobile users for SaaS apps such as Office 365.** With Windows, your users can self-provision their devices: - For corporate devices, they can set up corporate access with [Microsoft Entra join](/azure/active-directory/devices/overview). When you offer them Microsoft Entra join with automatic Intune MDM enrollment, they can bring devices into a corporate-managed state in [*one step*](https://techcommunity.microsoft.com/t5/azure-active-directory-identity/windows-10-azure-ad-and-microsoft-intune-automatic-mdm/ba-p/244067), all from the cloud. - Microsoft Entra join is also a great solution for temporary staff, partners, or other part-time employees. These accounts can be kept separate from the on-premises AD domain but still access needed corporate resources. + Microsoft Entra join is also a great solution for temporary staff, partners, or other part-time users. These accounts can be kept separate from the on-premises AD domain but still access needed corporate resources. - - Likewise, for personal devices, employees can use a new, simplified [BYOD experience](/azure/active-directory/devices/overview) to add their work account to Windows, then access work resources on the device. + - Likewise, for personal devices, users can use a new, simplified [BYOD experience](/azure/active-directory/devices/overview) to add their work account to Windows, then access work resources on the device. - **Domain joined PCs and tablets used for traditional applications and access to important resources.** These applications and resources may be traditional ones that require authentication or accessing highly sensitive or classified resources on-premises. @@ -71,7 +71,7 @@ As you review the roles in your organization, you can use the following generali ## Settings and configuration -Your configuration requirements are defined by multiple factors, including the level of management needed, the devices and data managed, and your industry requirements. Meanwhile, employees are frequently concerned about IT applying strict policies to their personal devices, but they still want access to corporate email and documents. You can create a consistent set of configurations across PCs, tablets, and phones through the common MDM layer. +Your configuration requirements are defined by multiple factors, including the level of management needed, the devices and data managed, and your industry requirements. Meanwhile, users are frequently concerned about IT applying strict policies to their personal devices, but they still want access to corporate email and documents. You can create a consistent set of configurations across PCs, tablets, and phones through the common MDM layer. - **MDM**: MDM gives you a way to configure settings that achieve your administrative intent without exposing every possible setting. (In contrast, group policy exposes fine-grained settings that you control individually.) One benefit of MDM is that it enables you to apply broader privacy, security, and application management settings through lighter and more efficient tools. MDM also allows you to target Internet-connected devices to manage policies without using group policy that requires on-premises domain-joined devices. This provision makes MDM the best choice for devices that are constantly on the go. diff --git a/windows/client-management/mdm-collect-logs.md b/windows/client-management/mdm-collect-logs.md index bc39a4ceb7..0a3b883dcd 100644 --- a/windows/client-management/mdm-collect-logs.md +++ b/windows/client-management/mdm-collect-logs.md @@ -2,7 +2,7 @@ title: Collect MDM logs description: Learn how to collect MDM logs. Examining these logs can help diagnose enrollment or device management issues in Windows devices managed by an MDM server. ms.topic: conceptual -ms.date: 08/10/2023 +ms.date: 07/08/2024 ms.collection: - highpri - tier2 @@ -40,7 +40,7 @@ mdmdiagnosticstool.exe -area "DeviceEnrollment;DeviceProvisioning;Autopilot" -zi ### Understanding zip structure -The zip file has logs according to the areas that were used in the command. This explanation is based on DeviceEnrollment, DeviceProvisioning and Autopilot areas. It applies to the zip files collected via command line or Feedback Hub +The zip file has logs according to the areas that were used in the command. This explanation is based on DeviceEnrollment, DeviceProvisioning, and Autopilot areas. It applies to the zip files collected via command line or Feedback Hub - DiagnosticLogCSP_Collector_Autopilot_*: Autopilot etls - DiagnosticLogCSP_Collector_DeviceProvisioning_*: Provisioning etls (Microsoft-Windows-Provisioning-Diagnostics-Provider) diff --git a/windows/client-management/mdm-diagnose-enrollment.md b/windows/client-management/mdm-diagnose-enrollment.md index 1d2c92bd1f..5610d29c34 100644 --- a/windows/client-management/mdm-diagnose-enrollment.md +++ b/windows/client-management/mdm-diagnose-enrollment.md @@ -2,7 +2,7 @@ title: Diagnose MDM enrollment failures description: Learn how to diagnose enrollment failures for Windows devices ms.topic: conceptual -ms.date: 08/10/2023 +ms.date: 07/08/2024 --- # Diagnose MDM enrollment diff --git a/windows/client-management/mdm-enrollment-of-windows-devices.md b/windows/client-management/mdm-enrollment-of-windows-devices.md index c3140fd86d..f57170b82c 100644 --- a/windows/client-management/mdm-enrollment-of-windows-devices.md +++ b/windows/client-management/mdm-enrollment-of-windows-devices.md @@ -5,12 +5,12 @@ ms.topic: conceptual ms.collection: - highpri - tier2 -ms.date: 08/10/2023 +ms.date: 07/08/2024 --- # MDM enrollment of Windows devices -In today's cloud-first world, enterprise IT departments increasingly want to let employees use their own devices, or even choose and purchase corporate-owned devices. Connecting your devices to work makes it easy for you to access your organization's resources, such as apps, the corporate network, and email. +In today's cloud-first world, enterprise IT departments increasingly want to let users use their own devices, or even choose and purchase corporate-owned devices. Connecting your devices to work makes it easy for you to access your organization's resources, such as apps, the corporate network, and email. > [!NOTE] > When you connect your device using mobile device management (MDM) enrollment, your organization may enforce certain policies on your device. @@ -24,8 +24,6 @@ You can connect corporate-owned devices to work by either joining the device to > [!NOTE] > For devices joined to on-premises Active Directory, see [Group policy enrollment](enroll-a-windows-10-device-automatically-using-group-policy.md). - - ### Connect your device to a Microsoft Entra domain (join Microsoft Entra ID) All Windows devices can be connected to a Microsoft Entra domain. These devices can be connected during OOBE. Additionally, desktop devices can be connected to a Microsoft Entra domain using the Settings app. diff --git a/windows/client-management/mdm-known-issues.md b/windows/client-management/mdm-known-issues.md index 10bd7ebaa1..43e571ecb6 100644 --- a/windows/client-management/mdm-known-issues.md +++ b/windows/client-management/mdm-known-issues.md @@ -2,7 +2,7 @@ title: Known issues in MDM description: Learn about known issues for Windows devices in MDM ms.topic: conceptual -ms.date: 08/10/2023 +ms.date: 07/08/2024 --- # Known issues @@ -11,11 +11,11 @@ ms.date: 08/10/2023 A Get command inside an atomic command isn't supported. -## Apps installed using WMI classes are not removed +## Apps installed using WMI classes aren't removed Applications installed using WMI classes aren't removed when the MDM account is removed from device. -## Passing CDATA in SyncML does not work +## Passing CDATA in SyncML doesn't work Passing CDATA in data in SyncML to ConfigManager and CSPs doesn't work. @@ -222,8 +222,6 @@ Alternatively you can use the following procedure to create an EAP Configuration After the MDM client automatically renews the WNS channel URI, the MDM client will immediately check in with the MDM server. Henceforth, for every MDM client check-in, the MDM server should send a GET request for "ProviderID/Push/ChannelURI" to retrieve the latest channel URI and compare it with the existing channel URI; then update the channel URI if necessary. - - ## User provisioning failure in Microsoft Entra joined devices For Microsoft Entra joined devices, provisioning `.\User` resources fails when the user isn't logged in as a Microsoft Entra user. If you attempt to join Microsoft Entra ID from **Settings** > **System** > **About** user interface, ensure to sign out and sign in with Microsoft Entra credentials to get your organizational configuration from your MDM server. This behavior is by design. @@ -232,6 +230,6 @@ For Microsoft Entra joined devices, provisioning `.\User` resources fails when t If you want to use the certificate used for VPN authentication also for Kerberos authentication (required if you need access to on-premises resources using NTLM or Kerberos), the user's certificate must meet the requirements for smart card certificate, the Subject field should contain the DNS domain name in the DN or the SAN should contain a fully qualified UPN so that the DC can be located from the DNS registrations. If certificates that don't meet these requirements are used for VPN, users may fail to access resources that require Kerberos authentication. -## Device management agent for the push-button reset is not working +## Device management agent for the push-button reset isn't working The DM agent for [push-button reset](/windows-hardware/manufacture/desktop/push-button-reset-overview) keeps the registry settings for OMA DM sessions, but deletes the task schedules. The client enrollment is retained, but it never syncs with the MDM service. diff --git a/windows/client-management/mdm-overview.md b/windows/client-management/mdm-overview.md index 7b31fe006a..7be2352c9b 100644 --- a/windows/client-management/mdm-overview.md +++ b/windows/client-management/mdm-overview.md @@ -1,7 +1,7 @@ --- title: Mobile Device Management overview description: Windows provides an enterprise-level solution to mobile management, to help IT pros comply with security policies while avoiding compromise of user's privacy. -ms.date: 08/10/2023 +ms.date: 07/08/2024 ms.topic: conceptual ms.localizationpriority: medium ms.collection: @@ -56,8 +56,6 @@ For information about the MDM policies defined in the Intune security baseline, No. Only one MDM is allowed. - - ### How do I set the maximum number of Microsoft Entra joined devices per user? 1. Sign in to the portal as tenant admin: . diff --git a/windows/client-management/mobile-device-enrollment.md b/windows/client-management/mobile-device-enrollment.md index 5d0537216a..214a73f052 100644 --- a/windows/client-management/mobile-device-enrollment.md +++ b/windows/client-management/mobile-device-enrollment.md @@ -2,7 +2,7 @@ title: Mobile device enrollment description: Learn how mobile device enrollment verifies that only authenticated and authorized devices are managed by the enterprise. ms.topic: conceptual -ms.date: 08/10/2023 +ms.date: 07/08/2024 ms.collection: - highpri - tier2 @@ -43,13 +43,13 @@ The certificate enrollment is an implementation of the MS-WSTEP protocol. ### Management configuration -The server sends provisioning XML that contains a server certificate (for TLS/SSL server authentication), a client certificate issued by enterprise CA, DM client bootstrap information (for the client to communicate with the management server), an enterprise application token (for the user to install enterprise applications), and the link to download the Company Hub application. +The server sends provisioning XML that contains a server certificate (for TLS/SSL server authentication), a client certificate issued by enterprise CA, DMClient bootstrap information (for the client to communicate with the management server), an enterprise application token (for the user to install enterprise applications), and the link to download the Company Hub application. The following articles describe the end-to-end enrollment process using various authentication methods: - [Federated authentication device enrollment](federated-authentication-device-enrollment.md) - [Certificate authentication device enrollment](certificate-authentication-device-enrollment.md) -- [On-premise authentication device enrollment](on-premise-authentication-device-enrollment.md) +- [On-premises authentication device enrollment](on-premise-authentication-device-enrollment.md) > [!NOTE] > As a best practice, don't use hardcoded server-side checks on values such as: @@ -168,4 +168,4 @@ TraceID is a freeform text node that is logged. It should identify the server si - [MDM enrollment of Windows-based devices](mdm-enrollment-of-windows-devices.md) - [Federated authentication device enrollment](federated-authentication-device-enrollment.md) - [Certificate authentication device enrollment](certificate-authentication-device-enrollment.md) -- [On-premise authentication device enrollment](on-premise-authentication-device-enrollment.md) +- [On-premises authentication device enrollment](on-premise-authentication-device-enrollment.md) diff --git a/windows/client-management/new-in-windows-mdm-enrollment-management.md b/windows/client-management/new-in-windows-mdm-enrollment-management.md index dcfbdeb34b..053a0dd779 100644 --- a/windows/client-management/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/new-in-windows-mdm-enrollment-management.md @@ -3,7 +3,7 @@ title: What's new in MDM enrollment and management description: Discover what's new and breaking changes in mobile device management (MDM) enrollment and management experience across all Windows devices. ms.topic: conceptual ms.localizationpriority: medium -ms.date: 08/10/2023 +ms.date: 07/08/2024 --- # What's new in mobile device enrollment and management diff --git a/windows/client-management/oma-dm-protocol-support.md b/windows/client-management/oma-dm-protocol-support.md index 3d1ff0619c..5caf42c5f0 100644 --- a/windows/client-management/oma-dm-protocol-support.md +++ b/windows/client-management/oma-dm-protocol-support.md @@ -2,7 +2,7 @@ title: OMA DM protocol support description: See how the OMA DM client communicates with the server over HTTPS and uses DM Sync (OMA DM v1.2) as the message payload. ms.topic: conceptual -ms.date: 08/10/2023 +ms.date: 07/08/2024 --- # OMA DM protocol support diff --git a/windows/client-management/on-premise-authentication-device-enrollment.md b/windows/client-management/on-premise-authentication-device-enrollment.md index 0d3a3b1a1d..e6c445b43c 100644 --- a/windows/client-management/on-premise-authentication-device-enrollment.md +++ b/windows/client-management/on-premise-authentication-device-enrollment.md @@ -2,7 +2,7 @@ title: On-premises authentication device enrollment description: This section provides an example of the mobile device enrollment protocol using on-premises authentication policy. ms.topic: conceptual -ms.date: 08/10/2023 +ms.date: 07/08/2024 --- # On-premises authentication device enrollment diff --git a/windows/client-management/push-notification-windows-mdm.md b/windows/client-management/push-notification-windows-mdm.md index 0ac4310aab..e0842698e8 100644 --- a/windows/client-management/push-notification-windows-mdm.md +++ b/windows/client-management/push-notification-windows-mdm.md @@ -2,7 +2,7 @@ title: Push notification support for device management description: The DMClient CSP supports the ability to configure push-initiated device management sessions. ms.topic: conceptual -ms.date: 08/10/2023 +ms.date: 07/08/2024 --- # Push notification support for device management diff --git a/windows/client-management/server-requirements-windows-mdm.md b/windows/client-management/server-requirements-windows-mdm.md index 6b3a303e0a..92e09679f4 100644 --- a/windows/client-management/server-requirements-windows-mdm.md +++ b/windows/client-management/server-requirements-windows-mdm.md @@ -2,7 +2,7 @@ title: Server requirements for using OMA DM to manage Windows devices description: Learn about the general server requirements for using OMA DM to manage Windows devices, including the supported versions of OMA DM. ms.topic: conceptual -ms.date: 08/10/2023 +ms.date: 07/08/2024 --- # Server requirements for using OMA DM to manage Windows devices @@ -11,11 +11,11 @@ The following list shows the general server requirements for using OMA DM to man - The OMA DM server must support the OMA DM v1.1.2 or later protocol. -- Secure Sockets Layer (TLS/SSL) must be on the OMA DM server, and it must provide server certificate-based authentication, data integrity check, and data encryption. If the certificate isn't issued by a commercial Certification Authority whose root certificate is preinstalled in the device, you must provision the enterprise root certificate in the device's Root store. +- Secure Sockets Layer (TLS/SSL) must be on the OMA DM server, and it must provide server certificate-based authentication, data integrity check, and data encryption. If the certificate isn't issued by a public Certification Authority whose root certificate is preinstalled in the device, you must provision the enterprise root certificate in the device's Root store. - To authenticate the client at the application level, you must use either Basic or MD5 client authentication. -- The server MD5 nonce must be renewed in each DM session. The DM client sends the new server nonce for the next session to the server over the Status element in every DM session. +- The server MD5 nonce must be renewed in each DM session. The DMClient sends the new server nonce for the next session to the server over the Status element in every DM session. - The MD5 binary nonce is sent over XML B64 encoded format, but the octal form of the binary data should be used when the service calculates the hash. diff --git a/windows/client-management/structure-of-oma-dm-provisioning-files.md b/windows/client-management/structure-of-oma-dm-provisioning-files.md index 170d213948..a1fcf0777c 100644 --- a/windows/client-management/structure-of-oma-dm-provisioning-files.md +++ b/windows/client-management/structure-of-oma-dm-provisioning-files.md @@ -2,7 +2,7 @@ title: Structure of OMA DM provisioning files description: Learn about the structure of OMA DM provisioning files, for example how each message is composed of a header, specified by the SyncHdr element, and a message body. ms.topic: conceptual -ms.date: 08/10/2023 +ms.date: 07/08/2024 --- # Structure of OMA DM provisioning files diff --git a/windows/client-management/understanding-admx-backed-policies.md b/windows/client-management/understanding-admx-backed-policies.md index 7b80861923..f327359fe3 100644 --- a/windows/client-management/understanding-admx-backed-policies.md +++ b/windows/client-management/understanding-admx-backed-policies.md @@ -2,7 +2,7 @@ title: Understanding ADMX policies description: You can use ADMX policies for Windows mobile device management (MDM) across Windows devices. ms.topic: conceptual -ms.date: 08/10/2023 +ms.date: 07/08/2024 --- # Understanding ADMX policies diff --git a/windows/client-management/using-powershell-scripting-with-the-wmi-bridge-provider.md b/windows/client-management/using-powershell-scripting-with-the-wmi-bridge-provider.md index 5fc0485080..ca347147ab 100644 --- a/windows/client-management/using-powershell-scripting-with-the-wmi-bridge-provider.md +++ b/windows/client-management/using-powershell-scripting-with-the-wmi-bridge-provider.md @@ -2,7 +2,7 @@ title: Using PowerShell scripting with the WMI Bridge Provider description: This article covers using PowerShell Cmdlet scripts to configure per-user and per-device policy settings, and how to invoke methods through the WMI Bridge Provider. ms.topic: conceptual -ms.date: 08/10/2023 +ms.date: 07/08/2024 --- # Using PowerShell scripting with the WMI Bridge Provider diff --git a/windows/client-management/win32-and-centennial-app-policy-configuration.md b/windows/client-management/win32-and-centennial-app-policy-configuration.md index ff1887a640..363072d68c 100644 --- a/windows/client-management/win32-and-centennial-app-policy-configuration.md +++ b/windows/client-management/win32-and-centennial-app-policy-configuration.md @@ -2,7 +2,7 @@ title: Win32 and Desktop Bridge app ADMX policy Ingestion description: Ingest ADMX files and set ADMX policies for Win32 and Desktop Bridge apps. ms.topic: conceptual -ms.date: 08/10/2023 +ms.date: 07/08/2024 --- # Win32 and Desktop Bridge app ADMX policy Ingestion diff --git a/windows/client-management/windows-mdm-enterprise-settings.md b/windows/client-management/windows-mdm-enterprise-settings.md index 03c28bfba7..a9b47a78e9 100644 --- a/windows/client-management/windows-mdm-enterprise-settings.md +++ b/windows/client-management/windows-mdm-enterprise-settings.md @@ -1,17 +1,17 @@ --- title: Enterprise settings and policy management -description: The DM client manages the interaction between a device and a server. Learn more about the client-server management workflow. +description: The DMClient manages the interaction between a device and a server. Learn more about the client-server management workflow. ms.topic: conceptual -ms.date: 08/10/2023 +ms.date: 07/08/2024 --- # Enterprise settings and policy management -The actual management interaction between the device and server is done via the DM client. The DM client communicates with the enterprise management server via DM v1.2 SyncML syntax. The full description of the OMA DM protocol v1.2 can be found at the [OMA website](https://technical.openmobilealliance.org/). +The actual management interaction between the device and server is done via the DMClient. The DMClient communicates with the enterprise management server via DM v1.2 SyncML syntax. The full description of the OMA DM protocol v1.2 can be found at the [OMA website](https://technical.openmobilealliance.org/). -Enterprise MDM settings are exposed via various configuration service providers to the DM client. For the list of available configuration service providers, see [Configuration service provider reference](mdm/index.yml). +Enterprise MDM settings are exposed via various configuration service providers to the DMClient. For the list of available configuration service providers, see [Configuration service provider reference](mdm/index.yml). -Windows currently supports one MDM server. The DM client that is configured via the enrollment process is granted access to enterprise related settings. During the enrollment process, the task scheduler is configured to invoke the DM client to periodically poll the MDM server. +Windows currently supports one MDM server. The DMClient that is configured via the enrollment process is granted access to enterprise related settings. During the enrollment process, the task scheduler is configured to invoke the DMClient to periodically poll the MDM server. The following diagram shows the work flow between server and client. @@ -21,9 +21,9 @@ The following diagram shows the work flow between server and client. This protocol defines an HTTPS-based client/server communication with DM SyncML XML as the package payload that carries management requests and execution results. The configuration request is addressed via a managed object (MO). The settings supported by the managed object are represented in a conceptual tree structure. This logical view of configurable device settings simplifies the way the server addresses the device settings by isolating the implementation details from the conceptual tree structure. -To facilitate security-enhanced communication with the remote server for enterprise management, Windows supports certificate-based mutual authentication over an encrypted TLS/SSL HTTP channel between the DM client and management service. The server and client certificates are provisioned during the enrollment process. +To facilitate security-enhanced communication with the remote server for enterprise management, Windows supports certificate-based mutual authentication over an encrypted TLS/SSL HTTP channel between the DMClient and management service. The server and client certificates are provisioned during the enrollment process. -The DM client configuration, company policy enforcement, business application management, and device inventory are all exposed or expressed via configuration service providers (CSPs). CSPs are the Windows term for managed objects. The DM client communicates with the server and sends configuration request to CSPs. The server only needs to know the logical local URIs defined by those CSP nodes in order to use the DM protocol XML to manage the device. +The DMClient configuration, company policy enforcement, business application management, and device inventory are all exposed or expressed via configuration service providers (CSPs). CSPs are the Windows term for managed objects. The DMClient communicates with the server and sends configuration request to CSPs. The server only needs to know the logical local URIs defined by those CSP nodes in order to use the DM protocol XML to manage the device. Here's a summary of the DM tasks supported for enterprise management: diff --git a/windows/client-management/wmi-providers-supported-in-windows.md b/windows/client-management/wmi-providers-supported-in-windows.md index 9afd80ebd2..610f0e36b9 100644 --- a/windows/client-management/wmi-providers-supported-in-windows.md +++ b/windows/client-management/wmi-providers-supported-in-windows.md @@ -2,7 +2,7 @@ title: WMI providers supported in Windows description: Manage settings and applications on devices that subscribe to the Mobile Device Management (MDM) service with Windows Management Infrastructure (WMI). ms.topic: conceptual -ms.date: 08/10/2023 +ms.date: 07/08/2024 --- # WMI providers supported in Windows From 547d66de3e69f73eca03cfedfa35f5d0386d0cf2 Mon Sep 17 00:00:00 2001 From: "Vinay Pamnani (from Dev Box)" Date: Mon, 8 Jul 2024 11:19:47 -0600 Subject: [PATCH 11/41] Update --- .../bulk-enrollment-using-windows-provisioning-tool.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/bulk-enrollment-using-windows-provisioning-tool.md b/windows/client-management/bulk-enrollment-using-windows-provisioning-tool.md index 2b0ca2a334..c248120cff 100644 --- a/windows/client-management/bulk-enrollment-using-windows-provisioning-tool.md +++ b/windows/client-management/bulk-enrollment-using-windows-provisioning-tool.md @@ -1,13 +1,13 @@ --- title: Bulk enrollment -description: Bulk enrollment is an efficient way to set up a large number of devices to manage by an MDM server without the need to reimage the devices. +description: Bulk enrollment is an efficient way to set up an MDM server to manage a large number of devices without the need to reimage the devices. ms.topic: conceptual ms.date: 07/08/2024 --- # Bulk enrollment using Windows Configuration Designer -Bulk enrollment is an efficient way to set up a large number of devices to manage by an MDM server without the need to reimage the devices. You can use the [Provisioning CSP](mdm/provisioning-csp.md) for bulk enrollment, except for the Microsoft Entra join enrollment scenario. +Bulk enrollment is an efficient way to set up an MDM server to manage a large number of devices without the need to reimage the devices. You can use the [Provisioning CSP](mdm/provisioning-csp.md) for bulk enrollment, except for the Microsoft Entra join enrollment scenario. ## Typical use cases From 419fe51e16743233f54044b6ff3a7a8f1ab47296 Mon Sep 17 00:00:00 2001 From: tiaraquan Date: Mon, 8 Jul 2024 10:48:26 -0700 Subject: [PATCH 12/41] Freshness --- .../deploy/windows-autopatch-groups-overview.md | 2 +- .../windows-autopatch-customize-windows-update-settings.md | 2 +- .../operate/windows-autopatch-device-alerts.md | 2 +- .../operate/windows-autopatch-exclude-device.md | 2 +- .../operate/windows-autopatch-groups-update-management.md | 2 +- .../windows-autopatch-manage-driver-and-firmware-updates.md | 2 +- ...dows-autopatch-manage-windows-feature-update-releases.md | 2 +- .../windows-autopatch-policy-health-and-remediation.md | 2 +- .../operate/windows-autopatch-unenroll-tenant.md | 2 +- .../windows-autopatch-windows-feature-update-overview.md | 2 +- ...indows-autopatch-windows-feature-update-status-report.md | 2 +- ...dows-autopatch-windows-feature-update-trending-report.md | 2 +- ...ndows-autopatch-windows-quality-update-communications.md | 6 +++--- ...windows-autopatch-windows-quality-update-end-user-exp.md | 6 +++--- .../windows-autopatch-windows-quality-update-overview.md | 2 +- .../windows-autopatch-windows-quality-update-signals.md | 6 +++--- ...indows-autopatch-windows-quality-update-status-report.md | 4 ++-- ...ws-autopatch-windows-quality-update-summary-dashboard.md | 2 +- ...dows-autopatch-windows-quality-update-trending-report.md | 4 ++-- 19 files changed, 27 insertions(+), 27 deletions(-) diff --git a/windows/deployment/windows-autopatch/deploy/windows-autopatch-groups-overview.md b/windows/deployment/windows-autopatch/deploy/windows-autopatch-groups-overview.md index 2e2ab90f1a..030de871bb 100644 --- a/windows/deployment/windows-autopatch/deploy/windows-autopatch-groups-overview.md +++ b/windows/deployment/windows-autopatch/deploy/windows-autopatch-groups-overview.md @@ -1,7 +1,7 @@ --- title: Windows Autopatch groups overview description: This article explains what Autopatch groups are -ms.date: 07/20/2023 +ms.date: 07/08/2024 ms.service: windows-client ms.subservice: itpro-updates ms.topic: conceptual diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-customize-windows-update-settings.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-customize-windows-update-settings.md index 8afa348a89..8425bd6056 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-customize-windows-update-settings.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-customize-windows-update-settings.md @@ -1,7 +1,7 @@ --- title: Customize Windows Update settings Autopatch groups experience description: How to customize Windows Updates with Autopatch groups -ms.date: 07/25/2023 +ms.date: 07/08/2024 ms.service: windows-client ms.subservice: itpro-updates ms.topic: how-to diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-device-alerts.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-device-alerts.md index b8373cff62..4556c227ea 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-device-alerts.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-device-alerts.md @@ -1,7 +1,7 @@ --- title: Device alerts description: Provide notifications and information about the necessary steps to keep your devices up to date. -ms.date: 08/01/2023 +ms.date: 07/08/2023 ms.service: windows-client ms.subservice: itpro-updates ms.topic: how-to diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-exclude-device.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-exclude-device.md index 89a23620fb..3bd258dff3 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-exclude-device.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-exclude-device.md @@ -1,7 +1,7 @@ --- title: Exclude a device description: This article explains how to exclude a device from the Windows Autopatch service -ms.date: 08/08/2023 +ms.date: 07/08/2024 ms.service: windows-client ms.subservice: itpro-updates ms.topic: how-to diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-update-management.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-update-management.md index b6e42c0987..ee20c918b3 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-update-management.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-update-management.md @@ -1,7 +1,7 @@ --- title: Software update management for Autopatch groups description: This article provides an overview of how updates are handled with Autopatch groups -ms.date: 07/25/2023 +ms.date: 07/08/2024 ms.service: windows-client ms.subservice: itpro-updates ms.topic: overview diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-manage-driver-and-firmware-updates.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-manage-driver-and-firmware-updates.md index 9c38e97260..d3a0379d03 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-manage-driver-and-firmware-updates.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-manage-driver-and-firmware-updates.md @@ -1,7 +1,7 @@ --- title: Manage driver and firmware updates description: This article explains how you can manage driver and firmware updates with Windows Autopatch -ms.date: 08/22/2023 +ms.date: 07/08/2024 ms.service: windows-client ms.subservice: itpro-updates ms.topic: how-to diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-manage-windows-feature-update-releases.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-manage-windows-feature-update-releases.md index 159e11b310..0ed4a2cdb6 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-manage-windows-feature-update-releases.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-manage-windows-feature-update-releases.md @@ -1,7 +1,7 @@ --- title: Manage Windows feature update releases description: This article explains how you can manage Windows feature updates with Autopatch groups -ms.date: 07/25/2023 +ms.date: 07/08/2024 ms.service: windows-client ms.subservice: itpro-updates ms.topic: conceptual diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-policy-health-and-remediation.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-policy-health-and-remediation.md index 208f3ef552..d0371e0e59 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-policy-health-and-remediation.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-policy-health-and-remediation.md @@ -1,7 +1,7 @@ --- title: policy health and remediation description: Describes what Autopatch does it detects policies in the tenant are either missing or modified to states that affect the service -ms.date: 07/25/2023 +ms.date: 07/08/2024 ms.service: windows-client ms.subservice: itpro-updates ms.topic: how-to diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-unenroll-tenant.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-unenroll-tenant.md index a628585c63..52ae00fad6 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-unenroll-tenant.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-unenroll-tenant.md @@ -1,7 +1,7 @@ --- title: Unenroll your tenant description: This article explains what unenrollment means for your organization and what actions you must take. -ms.date: 08/08/2023 +ms.date: 07/08/2024 ms.service: windows-client ms.subservice: itpro-updates ms.topic: how-to diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-overview.md index f0300bdd0c..2bf45427ed 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-overview.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-overview.md @@ -1,7 +1,7 @@ --- title: Windows feature updates overview description: This article explains how Windows feature updates are managed with Autopatch groups -ms.date: 07/25/2023 +ms.date: 07/08/2024 ms.service: windows-client ms.subservice: itpro-updates ms.topic: conceptual diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-status-report.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-status-report.md index 35f31b5ee8..d8e5c7be2a 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-status-report.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-status-report.md @@ -1,7 +1,7 @@ --- title: Feature update status report description: Provides a per device view of the current Windows OS upgrade status for all devices registered with Windows Autopatch. -ms.date: 07/25/2023 +ms.date: 07/08/2024 ms.service: windows-client ms.subservice: itpro-updates ms.topic: how-to diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-trending-report.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-trending-report.md index 9e08f94fd5..2d724d0af1 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-trending-report.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-trending-report.md @@ -1,7 +1,7 @@ --- title: Feature update trending report description: Provides a visual representation of Windows OS upgrade trends for all devices over the last 90 days. -ms.date: 07/25/2023 +ms.date: 07/08/2024 ms.service: windows-client ms.subservice: itpro-updates ms.topic: how-to diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-communications.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-communications.md index 2433c7acb7..4c86c00301 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-communications.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-communications.md @@ -1,7 +1,7 @@ --- -title: Windows quality update communications for Autopatch groups -description: This article explains Windows quality update communications for Autopatch groups -ms.date: 07/25/2023 +title: Windows quality update communications +description: This article explains Windows quality update communications +ms.date: 07/08/2024 ms.service: windows-client ms.subservice: itpro-updates ms.topic: conceptual diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-end-user-exp.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-end-user-exp.md index b0319f299b..5e617d6e2c 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-end-user-exp.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-end-user-exp.md @@ -1,7 +1,7 @@ --- -title: Windows quality update end user experience for Autopatch groups -description: This article explains the Windows quality update end user experience using the Autopatch groups exp -ms.date: 07/25/2023 +title: Windows quality update end user experience +description: This article explains the Windows quality update end user experience +ms.date: 07/08/2024 ms.service: windows-client ms.subservice: itpro-updates ms.topic: conceptual diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md index 4831b08a21..e9dc59e3a6 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md @@ -1,6 +1,6 @@ --- title: Windows quality updates overview with Autopatch groups experience -description: This article explains how Windows quality updates are managed with Autopatch groups +description: This article explains how Windows quality updates are managed with Autopatch ms.date: 05/24/2024 ms.service: windows-client ms.subservice: itpro-updates diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-signals.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-signals.md index 7f403c3a2c..caf9f9c2c5 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-signals.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-signals.md @@ -1,7 +1,7 @@ --- -title: Windows quality update release signals with Autopatch groups -description: This article explains the Windows quality update release signals with Autopatch groups -ms.date: 07/25/2023 +title: Windows quality update release signals +description: This article explains the Windows quality update release signals +ms.date: 07/08/2024 ms.service: windows-client ms.subservice: itpro-updates ms.topic: conceptual diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-status-report.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-status-report.md index 2d99ee3d3a..34b11def99 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-status-report.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-status-report.md @@ -1,7 +1,7 @@ --- title: Quality update status report -description: Provides a per device view of the current update status for all Windows Autopatch enrolled devices with Autopatch groups. -ms.date: 07/25/2023 +description: Provides a per device view of the current update status for all Windows Autopatch enrolled devices. +ms.date: 07/08/2024 ms.service: windows-client ms.subservice: itpro-updates ms.topic: how-to diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-summary-dashboard.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-summary-dashboard.md index 64ed6a7a91..21c684b548 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-summary-dashboard.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-summary-dashboard.md @@ -1,6 +1,6 @@ --- title: Windows quality update summary dashboard -description: Provides a summary view of the current update status for all devices enrolled into Windows Autopatch with Autopatch groups +description: Provides a summary view of the current update status for all devices enrolled into Windows Autopatch ms.date: 01/22/2024 ms.service: windows-client ms.subservice: itpro-updates diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-trending-report.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-trending-report.md index ccfb4fd07a..a956837968 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-trending-report.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-trending-report.md @@ -1,7 +1,7 @@ --- title: Quality update trending report -description: Provides a visual representation of the update status trend for all devices over the last 90 days with Autopatch groups. -ms.date: 09/01/2023 +description: Provides a visual representation of the update status trend for all devices over the last 90 days. +ms.date: 07/08/2024 ms.service: windows-client ms.subservice: itpro-updates ms.topic: how-to From d42306cfe8c352138f624b41423d69f0f6d9c46a Mon Sep 17 00:00:00 2001 From: tiaraquan Date: Mon, 8 Jul 2024 11:06:41 -0700 Subject: [PATCH 13/41] More freshness --- .../deploy/windows-autopatch-admin-contacts.md | 2 +- .../deploy/windows-autopatch-groups-manage-autopatch-groups.md | 2 +- .../deploy/windows-autopatch-post-reg-readiness-checks.md | 2 +- .../overview/windows-autopatch-deployment-guide.md | 2 +- .../windows-autopatch/overview/windows-autopatch-faq.yml | 2 +- .../windows-autopatch/overview/windows-autopatch-overview.md | 2 +- .../windows-autopatch/overview/windows-autopatch-privacy.md | 2 +- .../overview/windows-autopatch-roles-responsibilities.md | 2 +- .../prepare/windows-autopatch-configure-network.md | 2 +- .../prepare/windows-autopatch-enroll-tenant.md | 2 +- .../prepare/windows-autopatch-enrollment-support-request.md | 2 +- .../windows-autopatch/prepare/windows-autopatch-fix-issues.md | 2 +- .../references/windows-autopatch-conflicting-configurations.md | 2 +- ...patch-driver-and-firmware-updates-public-preview-addendum.md | 2 +- .../references/windows-autopatch-microsoft-365-policies.md | 2 +- .../windows-autopatch-windows-update-unsupported-policies.md | 2 +- 16 files changed, 16 insertions(+), 16 deletions(-) diff --git a/windows/deployment/windows-autopatch/deploy/windows-autopatch-admin-contacts.md b/windows/deployment/windows-autopatch/deploy/windows-autopatch-admin-contacts.md index 690fe5613b..be8a0b2063 100644 --- a/windows/deployment/windows-autopatch/deploy/windows-autopatch-admin-contacts.md +++ b/windows/deployment/windows-autopatch/deploy/windows-autopatch-admin-contacts.md @@ -1,7 +1,7 @@ --- title: Add and verify admin contacts description: This article explains how to add and verify admin contacts -ms.date: 09/15/2023 +ms.date: 07/08/2024 ms.service: windows-client ms.subservice: itpro-updates ms.topic: how-to diff --git a/windows/deployment/windows-autopatch/deploy/windows-autopatch-groups-manage-autopatch-groups.md b/windows/deployment/windows-autopatch/deploy/windows-autopatch-groups-manage-autopatch-groups.md index e541bf8d2e..cd9cd8132d 100644 --- a/windows/deployment/windows-autopatch/deploy/windows-autopatch-groups-manage-autopatch-groups.md +++ b/windows/deployment/windows-autopatch/deploy/windows-autopatch-groups-manage-autopatch-groups.md @@ -1,7 +1,7 @@ --- title: Manage Windows Autopatch groups description: This article explains how to manage Autopatch groups -ms.date: 12/13/2023 +ms.date: 07/08/2024 ms.service: windows-client ms.subservice: itpro-updates ms.topic: how-to diff --git a/windows/deployment/windows-autopatch/deploy/windows-autopatch-post-reg-readiness-checks.md b/windows/deployment/windows-autopatch/deploy/windows-autopatch-post-reg-readiness-checks.md index e48ce95422..bbed3ec3b1 100644 --- a/windows/deployment/windows-autopatch/deploy/windows-autopatch-post-reg-readiness-checks.md +++ b/windows/deployment/windows-autopatch/deploy/windows-autopatch-post-reg-readiness-checks.md @@ -1,7 +1,7 @@ --- title: Post-device registration readiness checks description: This article details how post-device registration readiness checks are performed in Windows Autopatch -ms.date: 09/16/2023 +ms.date: 07/08/2024 ms.service: windows-client ms.subservice: itpro-updates ms.topic: conceptual diff --git a/windows/deployment/windows-autopatch/overview/windows-autopatch-deployment-guide.md b/windows/deployment/windows-autopatch/overview/windows-autopatch-deployment-guide.md index 82e1181f87..df3a6cd77d 100644 --- a/windows/deployment/windows-autopatch/overview/windows-autopatch-deployment-guide.md +++ b/windows/deployment/windows-autopatch/overview/windows-autopatch-deployment-guide.md @@ -1,7 +1,7 @@ --- title: Windows Autopatch deployment guide description: This guide explains how to successfully deploy Windows Autopatch in your environment -ms.date: 08/24/2023 +ms.date: 07/08/2024 ms.service: windows-client ms.subservice: itpro-updates ms.topic: how-to diff --git a/windows/deployment/windows-autopatch/overview/windows-autopatch-faq.yml b/windows/deployment/windows-autopatch/overview/windows-autopatch-faq.yml index f92f2bf122..8e0f87c3a4 100644 --- a/windows/deployment/windows-autopatch/overview/windows-autopatch-faq.yml +++ b/windows/deployment/windows-autopatch/overview/windows-autopatch-faq.yml @@ -4,7 +4,7 @@ metadata: description: Answers to frequently asked questions about Windows Autopatch. ms.service: windows-client ms.topic: faq - ms.date: 12/04/2023 + ms.date: 07/08/2024 audience: itpro ms.localizationpriority: medium manager: aaroncz diff --git a/windows/deployment/windows-autopatch/overview/windows-autopatch-overview.md b/windows/deployment/windows-autopatch/overview/windows-autopatch-overview.md index 6e49a4703c..f5f9d6ac76 100644 --- a/windows/deployment/windows-autopatch/overview/windows-autopatch-overview.md +++ b/windows/deployment/windows-autopatch/overview/windows-autopatch-overview.md @@ -1,7 +1,7 @@ --- title: What is Windows Autopatch? description: Details what the service is and shortcuts to articles. -ms.date: 08/08/2023 +ms.date: 07/08/2024 ms.service: windows-client ms.subservice: itpro-updates ms.topic: conceptual diff --git a/windows/deployment/windows-autopatch/overview/windows-autopatch-privacy.md b/windows/deployment/windows-autopatch/overview/windows-autopatch-privacy.md index 4ef883d665..5b74de7688 100644 --- a/windows/deployment/windows-autopatch/overview/windows-autopatch-privacy.md +++ b/windows/deployment/windows-autopatch/overview/windows-autopatch-privacy.md @@ -1,7 +1,7 @@ --- title: Privacy description: This article provides details about the data platform and privacy compliance for Autopatch -ms.date: 09/13/2023 +ms.date: 07/08/2024 ms.service: windows-client ms.subservice: itpro-updates ms.topic: reference diff --git a/windows/deployment/windows-autopatch/overview/windows-autopatch-roles-responsibilities.md b/windows/deployment/windows-autopatch/overview/windows-autopatch-roles-responsibilities.md index f2217c4b0c..b62bc5627b 100644 --- a/windows/deployment/windows-autopatch/overview/windows-autopatch-roles-responsibilities.md +++ b/windows/deployment/windows-autopatch/overview/windows-autopatch-roles-responsibilities.md @@ -1,7 +1,7 @@ --- title: Roles and responsibilities description: This article describes the roles and responsibilities provided by Windows Autopatch and what the customer must do -ms.date: 08/31/2023 +ms.date: 07/08/2024 ms.service: windows-client ms.subservice: itpro-updates ms.topic: conceptual diff --git a/windows/deployment/windows-autopatch/prepare/windows-autopatch-configure-network.md b/windows/deployment/windows-autopatch/prepare/windows-autopatch-configure-network.md index 2633222ae7..dcbb1ae24c 100644 --- a/windows/deployment/windows-autopatch/prepare/windows-autopatch-configure-network.md +++ b/windows/deployment/windows-autopatch/prepare/windows-autopatch-configure-network.md @@ -1,7 +1,7 @@ --- title: Configure your network description: This article details the network configurations needed for Windows Autopatch -ms.date: 09/15/2023 +ms.date: 07/08/2024 ms.service: windows-client ms.subservice: itpro-updates ms.topic: how-to diff --git a/windows/deployment/windows-autopatch/prepare/windows-autopatch-enroll-tenant.md b/windows/deployment/windows-autopatch/prepare/windows-autopatch-enroll-tenant.md index b24d784042..f623474036 100644 --- a/windows/deployment/windows-autopatch/prepare/windows-autopatch-enroll-tenant.md +++ b/windows/deployment/windows-autopatch/prepare/windows-autopatch-enroll-tenant.md @@ -1,7 +1,7 @@ --- title: Enroll your tenant description: This article details how to enroll your tenant -ms.date: 09/15/2023 +ms.date: 07/08/2024 ms.service: windows-client ms.subservice: itpro-updates ms.topic: how-to diff --git a/windows/deployment/windows-autopatch/prepare/windows-autopatch-enrollment-support-request.md b/windows/deployment/windows-autopatch/prepare/windows-autopatch-enrollment-support-request.md index c349ad620f..6cd8d98e22 100644 --- a/windows/deployment/windows-autopatch/prepare/windows-autopatch-enrollment-support-request.md +++ b/windows/deployment/windows-autopatch/prepare/windows-autopatch-enrollment-support-request.md @@ -1,7 +1,7 @@ --- title: Submit a tenant enrollment support request description: This article details how to submit a tenant enrollment support request -ms.date: 09/13/2023 +ms.date: 07/08/2024 ms.service: windows-client ms.subservice: itpro-updates ms.topic: how-to diff --git a/windows/deployment/windows-autopatch/prepare/windows-autopatch-fix-issues.md b/windows/deployment/windows-autopatch/prepare/windows-autopatch-fix-issues.md index b2371addb0..d973c0f991 100644 --- a/windows/deployment/windows-autopatch/prepare/windows-autopatch-fix-issues.md +++ b/windows/deployment/windows-autopatch/prepare/windows-autopatch-fix-issues.md @@ -1,7 +1,7 @@ --- title: Fix issues found by the Readiness assessment tool description: This article details how to fix issues found by the Readiness assessment tool. -ms.date: 09/12/2023 +ms.date: 07/08/2024 ms.service: windows-client ms.subservice: itpro-updates ms.topic: how-to diff --git a/windows/deployment/windows-autopatch/references/windows-autopatch-conflicting-configurations.md b/windows/deployment/windows-autopatch/references/windows-autopatch-conflicting-configurations.md index 677faf730d..cbd7fc1142 100644 --- a/windows/deployment/windows-autopatch/references/windows-autopatch-conflicting-configurations.md +++ b/windows/deployment/windows-autopatch/references/windows-autopatch-conflicting-configurations.md @@ -1,7 +1,7 @@ --- title: Conflicting configurations description: This article explains how to remediate conflicting configurations affecting the Windows Autopatch service. -ms.date: 09/05/2023 +ms.date: 07/08/2024 ms.service: windows-client ms.subservice: itpro-updates ms.topic: conceptual diff --git a/windows/deployment/windows-autopatch/references/windows-autopatch-driver-and-firmware-updates-public-preview-addendum.md b/windows/deployment/windows-autopatch/references/windows-autopatch-driver-and-firmware-updates-public-preview-addendum.md index 9edb3f3748..8cbed6ce25 100644 --- a/windows/deployment/windows-autopatch/references/windows-autopatch-driver-and-firmware-updates-public-preview-addendum.md +++ b/windows/deployment/windows-autopatch/references/windows-autopatch-driver-and-firmware-updates-public-preview-addendum.md @@ -1,7 +1,7 @@ --- title: Driver and firmware updates for Windows Autopatch Public Preview Addendum description: This article explains how driver and firmware updates are managed in Autopatch -ms.date: 06/26/2023 +ms.date: 07/08/2024 ms.service: windows-client ms.subservice: itpro-updates ms.topic: conceptual diff --git a/windows/deployment/windows-autopatch/references/windows-autopatch-microsoft-365-policies.md b/windows/deployment/windows-autopatch/references/windows-autopatch-microsoft-365-policies.md index c08d4cf821..56d474d0f9 100644 --- a/windows/deployment/windows-autopatch/references/windows-autopatch-microsoft-365-policies.md +++ b/windows/deployment/windows-autopatch/references/windows-autopatch-microsoft-365-policies.md @@ -1,7 +1,7 @@ --- title: Microsoft 365 Apps for enterprise update policies description: This article explains the Microsoft 365 Apps for enterprise policies in Windows Autopatch -ms.date: 06/23/2023 +ms.date: 07/08/2024 ms.service: windows-client ms.subservice: itpro-updates ms.topic: conceptual diff --git a/windows/deployment/windows-autopatch/references/windows-autopatch-windows-update-unsupported-policies.md b/windows/deployment/windows-autopatch/references/windows-autopatch-windows-update-unsupported-policies.md index df04f475d9..5e6dfd39cc 100644 --- a/windows/deployment/windows-autopatch/references/windows-autopatch-windows-update-unsupported-policies.md +++ b/windows/deployment/windows-autopatch/references/windows-autopatch-windows-update-unsupported-policies.md @@ -1,7 +1,7 @@ --- title: Windows update policies description: This article explains Windows update policies in Windows Autopatch -ms.date: 09/02/2023 +ms.date: 07/08/2024 ms.service: windows-client ms.subservice: itpro-updates ms.topic: conceptual From 732f1f50b75a41404125e9ddb9e791e86bd8a869 Mon Sep 17 00:00:00 2001 From: "Vinay Pamnani (from Dev Box)" Date: Mon, 8 Jul 2024 13:58:02 -0600 Subject: [PATCH 14/41] Fix Pro applicability for some CSPs --- .../mdm/policy-csp-admx-windowsstore.md | 10 +++------- windows/client-management/mdm/policy-csp-search.md | 4 ++-- 2 files changed, 5 insertions(+), 9 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-admx-windowsstore.md b/windows/client-management/mdm/policy-csp-admx-windowsstore.md index ad9da6b96b..aaadbfb085 100644 --- a/windows/client-management/mdm/policy-csp-admx-windowsstore.md +++ b/windows/client-management/mdm/policy-csp-admx-windowsstore.md @@ -1,7 +1,7 @@ --- title: ADMX_WindowsStore Policy CSP description: Learn more about the ADMX_WindowsStore Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 07/08/2024 --- @@ -200,7 +200,7 @@ Enables or disables the Store offer to update to the latest version of Windows. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ❌ Device
βœ… User | βœ… Pro
βœ… Enterprise
βœ… Education
βœ… Windows SE
βœ… IoT Enterprise / IoT Enterprise LTSC | βœ… Windows 10, version 2004 [10.0.19041.1202] and later
βœ… Windows 10, version 2009 [10.0.19042.1202] and later
βœ… Windows 10, version 21H1 [10.0.19043.1202] and later
βœ… Windows 11, version 21H2 [10.0.22000] and later | +| ❌ Device
βœ… User | ❌ Pro
βœ… Enterprise
βœ… Education
βœ… Windows SE
βœ… IoT Enterprise / IoT Enterprise LTSC | βœ… Windows 10, version 2004 [10.0.19041.1202] and later
βœ… Windows 10, version 2009 [10.0.19042.1202] and later
βœ… Windows 10, version 21H1 [10.0.19043.1202] and later
βœ… Windows 11, version 21H2 [10.0.22000] and later | @@ -220,8 +220,6 @@ Denies or allows access to the Store application. -> [!NOTE] -> This policy is not supported on Windows Professional edition, and requires Windows Enterprise or Windows Education to function. For more information, see [Can't disable Microsoft Store in Windows Pro through Group Policy](/troubleshoot/windows-client/group-policy/cannot-disable-microsoft-store). @@ -261,7 +259,7 @@ Denies or allows access to the Store application. | Scope | Editions | Applicable OS | |:--|:--|:--| -| βœ… Device
❌ User | βœ… Pro
βœ… Enterprise
βœ… Education
βœ… Windows SE
βœ… IoT Enterprise / IoT Enterprise LTSC | βœ… Windows 10, version 2004 [10.0.19041.1202] and later
βœ… Windows 10, version 2009 [10.0.19042.1202] and later
βœ… Windows 10, version 21H1 [10.0.19043.1202] and later
βœ… Windows 11, version 21H2 [10.0.22000] and later | +| βœ… Device
❌ User | ❌ Pro
βœ… Enterprise
βœ… Education
βœ… Windows SE
βœ… IoT Enterprise / IoT Enterprise LTSC | βœ… Windows 10, version 2004 [10.0.19041.1202] and later
βœ… Windows 10, version 2009 [10.0.19042.1202] and later
βœ… Windows 10, version 21H1 [10.0.19043.1202] and later
βœ… Windows 11, version 21H2 [10.0.22000] and later | @@ -281,8 +279,6 @@ Denies or allows access to the Store application. -> [!NOTE] -> This policy is not supported on Windows Professional edition, and requires Windows Enterprise or Windows Education to function. For more information, see [Can't disable Microsoft Store in Windows Pro through Group Policy](/troubleshoot/windows-client/group-policy/cannot-disable-microsoft-store). diff --git a/windows/client-management/mdm/policy-csp-search.md b/windows/client-management/mdm/policy-csp-search.md index 1260cd7ab1..8734513a6e 100644 --- a/windows/client-management/mdm/policy-csp-search.md +++ b/windows/client-management/mdm/policy-csp-search.md @@ -1,7 +1,7 @@ --- title: Search Policy CSP description: Learn more about the Search Area in Policy CSP. -ms.date: 04/10/2024 +ms.date: 07/08/2024 --- @@ -919,7 +919,7 @@ This policy setting configures whether or not locations on removable drives can | Scope | Editions | Applicable OS | |:--|:--|:--| -| βœ… Device
❌ User | βœ… Pro
βœ… Enterprise
βœ… Education
βœ… Windows SE
βœ… IoT Enterprise / IoT Enterprise LTSC | βœ… Windows 10, version 1803 [10.0.17134] and later | +| βœ… Device
❌ User | ❌ Pro
βœ… Enterprise
βœ… Education
βœ… Windows SE
βœ… IoT Enterprise / IoT Enterprise LTSC | βœ… Windows 10, version 1803 [10.0.17134] and later | From df4f324c3c54d0b44800c1d1a352db797634c05f Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Tue, 9 Jul 2024 08:20:57 -0700 Subject: [PATCH 15/41] mdag-dep-link-fix --- windows/whats-new/deprecated-features.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/whats-new/deprecated-features.md b/windows/whats-new/deprecated-features.md index 0b43cfa4e9..6d5b59a3ba 100644 --- a/windows/whats-new/deprecated-features.md +++ b/windows/whats-new/deprecated-features.md @@ -1,7 +1,7 @@ --- title: Deprecated features in the Windows client description: Review the list of features that Microsoft is no longer actively developing in Windows 10 and Windows 11. -ms.date: 06/11/2024 +ms.date: 07/09/2024 ms.service: windows-client ms.subservice: itpro-fundamentals ms.localizationpriority: medium @@ -54,7 +54,7 @@ The features in this article are no longer being actively developed, and might b | TLS server authentication certificates using RSA keys with key lengths shorter than 2048 bits | Support for certificates using RSA keys with key lengths shorter than 2048 bits will be deprecated. Internet standards and regulatory bodies disallowed the use of 1024-bit keys in 2013, recommending specifically that RSA keys should have a key length of 2048 bits or longer. For more information, see [Transitioning of Cryptographic Algorithms and Key Sizes - Discussion Paper (nist.gov)](https://csrc.nist.gov/CSRC/media/Projects/Key-Management/documents/transitions/Transitioning_CryptoAlgos_070209.pdf). This deprecation focuses on ensuring that all RSA certificates used for TLS server authentication must have key lengths greater than or equal to 2048 bits to be considered valid by Windows.

TLS certificates issued by enterprise or test certification authorities (CA) aren't impacted with this change. However, we recommend that they be updated to RSA keys greater than or equal to 2048 bits as a security best practice. This change is necessary to preserve security of Windows customers using certificates for authentication and cryptographic purposes.| March 2024| | Test Base | [Test Base for Microsoft 365](/microsoft-365/test-base/overview), an Azure cloud service for application testing, is deprecated. The service will be retired in the future and will be no longer available for use after retirement. | March 2024 | | Windows Mixed Reality | [Windows Mixed Reality](/windows/mixed-reality/enthusiast-guide/before-you-start) is deprecated and will be removed in Windows 11, version 24H2. This deprecation includes the [Mixed Reality Portal](/windows/mixed-reality/enthusiast-guide/install-windows-mixed-reality) app, [Windows Mixed Reality for SteamVR](/windows/mixed-reality/enthusiast-guide/using-steamvr-with-windows-mixed-reality), and Steam VR Beta.β€―Existing Windows Mixed Reality devices will continue to work with Steam through November 2026, if users remain on their current released version of Windows 11, version 23H2. After November 2026, Windows Mixed Reality will no longer receive security updates, nonsecurity updates, bug fixes, technical support, or online technical content updates.

This deprecation doesn't affect HoloLens. We remain committed to HoloLens and our enterprise customers. | December 2023 | -| Microsoft Defender Application Guard for Edge | [Microsoft Defender Application Guard](/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-overview), including the [Windows Isolated App Launcher APIs](/windows/win32/api/isolatedapplauncher/), is being deprecated for Microsoft Edge for Business and [will no longer be updated](feature-lifecycle.md). Please download the [Microsoft Edge For Business Security Whitepaper](https://edgestatic.azureedge.net/shared/cms/pdfs/Microsoft_Edge_Security_Whitepaper_v2.pdf) to learn more about Edge for Business security capabilities.

**[Update - April 2024]**: Because Application Guard is deprecated there will not be a migration to Edge Manifest V3. The corresponding extensions and associated [Windows Store app](https://apps.microsoft.com/detail/9N8GNLC8Z9C8) will not be available after May 2024. This affects the following browsers: [*Application Guard Extension - Chrome*](https://chromewebstore.google.com/detail/application-guard-extensi/mfjnknhkkiafjajicegabkbimfhplplj) and [*Application Guard Extension - Firefox*](https://addons.mozilla.org/firefox/addon/application-guard-extension/). If you want to block unprotected browsers until you are ready to retire MDAG usage in your enterprise, we recommend using AppLocker policies or [Microsoft Edge management service](/deployedge/microsoft-edge-management-service). For more information, see [Microsoft Edge and Microsoft Defender Application Guard](/deployedge/microsoft-edge-security-windows-defender-application-guard). | December 2023 | +| Microsoft Defender Application Guard for Edge | [Microsoft Defender Application Guard](/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-overview), including the [Windows Isolated App Launcher APIs](/windows/win32/api/isolatedapplauncher/), is being deprecated for Microsoft Edge for Business and [will no longer be updated](feature-lifecycle.md). Please download the [Microsoft Edge For Business Security Whitepaper](https://edgestatic.azureedge.net/shared/cms/pdfs/Microsoft_Edge_Security_Whitepaper_v2.pdf) to learn more about Edge for Business security capabilities.

**[Update - April 2024]**: Because Application Guard is deprecated there will not be a migration to Edge Manifest V3. The corresponding extensions and associated [Windows Store app](https://apps.microsoft.com/detail/9N8GNLC8Z9C8) will not be available after May 2024. This affects the following browsers: *Application Guard Extension - Chrome* and *Application Guard Extension - Firefox*. If you want to block unprotected browsers until you are ready to retire MDAG usage in your enterprise, we recommend using AppLocker policies or [Microsoft Edge management service](/deployedge/microsoft-edge-management-service). For more information, see [Microsoft Edge and Microsoft Defender Application Guard](/deployedge/microsoft-edge-security-windows-defender-application-guard). | December 2023 | | Legacy console mode | The [legacy console mode](/windows/console/legacymode) is deprecated and no longer being updated. In future Windows releases, it will be available as an optional [Feature on Demand](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities). This feature won't be installed by default. | December 2023 | | Windows speech recognition | [Windows speech recognition](https://support.microsoft.com/windows/83ff75bd-63eb-0b6c-18d4-6fae94050571) is deprecated and is no longer being developed. This feature is being replaced with [voice access](https://support.microsoft.com/topic/4dcd23ee-f1b9-4fd1-bacc-862ab611f55d). Voice access is available for Windows 11, version 22H2, or later devices. Currently, voice access supports five English locales: English - US, English - UK, English - India, English - New Zealand, English - Canada, and English - Australia. For more information, see [Setup voice access](https://support.microsoft.com/topic/set-up-voice-access-9fc44e29-12bf-4d86-bc4e-e9bb69df9a0e). | December 2023 | | Microsoft Defender Application Guard for Office | [Microsoft Defender Application Guard for Office](/microsoft-365/security/office-365-security/app-guard-for-office-install), including the [Windows Isolated App Launcher APIs](/windows/win32/api/isolatedapplauncher/), is being deprecated and will no longer be updated. We recommend transitioning to Microsoft Defender for Endpoint [attack surface reduction rules](/microsoft-365/security/defender-endpoint/overview-attack-surface-reduction) along with [Protected View](/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365#global-settings-for-safe-attachments) and [Windows Defender Application Control](/windows/security/application-security/application-control/windows-defender-application-control/wdac). | November 2023 | From 12446859950626f4efdd25886affe7d51f8596d7 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Tue, 9 Jul 2024 08:22:56 -0700 Subject: [PATCH 16/41] mdag-dep-link-fix --- windows/whats-new/deprecated-features.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/deprecated-features.md b/windows/whats-new/deprecated-features.md index 6d5b59a3ba..4c4a6712c3 100644 --- a/windows/whats-new/deprecated-features.md +++ b/windows/whats-new/deprecated-features.md @@ -54,7 +54,7 @@ The features in this article are no longer being actively developed, and might b | TLS server authentication certificates using RSA keys with key lengths shorter than 2048 bits | Support for certificates using RSA keys with key lengths shorter than 2048 bits will be deprecated. Internet standards and regulatory bodies disallowed the use of 1024-bit keys in 2013, recommending specifically that RSA keys should have a key length of 2048 bits or longer. For more information, see [Transitioning of Cryptographic Algorithms and Key Sizes - Discussion Paper (nist.gov)](https://csrc.nist.gov/CSRC/media/Projects/Key-Management/documents/transitions/Transitioning_CryptoAlgos_070209.pdf). This deprecation focuses on ensuring that all RSA certificates used for TLS server authentication must have key lengths greater than or equal to 2048 bits to be considered valid by Windows.

TLS certificates issued by enterprise or test certification authorities (CA) aren't impacted with this change. However, we recommend that they be updated to RSA keys greater than or equal to 2048 bits as a security best practice. This change is necessary to preserve security of Windows customers using certificates for authentication and cryptographic purposes.| March 2024| | Test Base | [Test Base for Microsoft 365](/microsoft-365/test-base/overview), an Azure cloud service for application testing, is deprecated. The service will be retired in the future and will be no longer available for use after retirement. | March 2024 | | Windows Mixed Reality | [Windows Mixed Reality](/windows/mixed-reality/enthusiast-guide/before-you-start) is deprecated and will be removed in Windows 11, version 24H2. This deprecation includes the [Mixed Reality Portal](/windows/mixed-reality/enthusiast-guide/install-windows-mixed-reality) app, [Windows Mixed Reality for SteamVR](/windows/mixed-reality/enthusiast-guide/using-steamvr-with-windows-mixed-reality), and Steam VR Beta.β€―Existing Windows Mixed Reality devices will continue to work with Steam through November 2026, if users remain on their current released version of Windows 11, version 23H2. After November 2026, Windows Mixed Reality will no longer receive security updates, nonsecurity updates, bug fixes, technical support, or online technical content updates.

This deprecation doesn't affect HoloLens. We remain committed to HoloLens and our enterprise customers. | December 2023 | -| Microsoft Defender Application Guard for Edge | [Microsoft Defender Application Guard](/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-overview), including the [Windows Isolated App Launcher APIs](/windows/win32/api/isolatedapplauncher/), is being deprecated for Microsoft Edge for Business and [will no longer be updated](feature-lifecycle.md). Please download the [Microsoft Edge For Business Security Whitepaper](https://edgestatic.azureedge.net/shared/cms/pdfs/Microsoft_Edge_Security_Whitepaper_v2.pdf) to learn more about Edge for Business security capabilities.

**[Update - April 2024]**: Because Application Guard is deprecated there will not be a migration to Edge Manifest V3. The corresponding extensions and associated [Windows Store app](https://apps.microsoft.com/detail/9N8GNLC8Z9C8) will not be available after May 2024. This affects the following browsers: *Application Guard Extension - Chrome* and *Application Guard Extension - Firefox*. If you want to block unprotected browsers until you are ready to retire MDAG usage in your enterprise, we recommend using AppLocker policies or [Microsoft Edge management service](/deployedge/microsoft-edge-management-service). For more information, see [Microsoft Edge and Microsoft Defender Application Guard](/deployedge/microsoft-edge-security-windows-defender-application-guard). | December 2023 | +| Microsoft Defender Application Guard for Edge | [Microsoft Defender Application Guard](/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-overview), including the [Windows Isolated App Launcher APIs](/windows/win32/api/isolatedapplauncher/), is being deprecated for Microsoft Edge for Business and [will no longer be updated](feature-lifecycle.md). Please download the [Microsoft Edge For Business Security Whitepaper](https://edgestatic.azureedge.net/shared/cms/pdfs/Microsoft_Edge_Security_Whitepaper_v2.pdf) to learn more about Edge for Business security capabilities.

**[Update - April 2024]**: Because Application Guard is deprecated there will not be a migration to Edge Manifest V3. The corresponding extensions and associated Windows Store app will not be available after May 2024. This affects the following browsers: *Application Guard Extension - Chrome* and *Application Guard Extension - Firefox*. If you want to block unprotected browsers until you are ready to retire MDAG usage in your enterprise, we recommend using AppLocker policies or [Microsoft Edge management service](/deployedge/microsoft-edge-management-service). For more information, see [Microsoft Edge and Microsoft Defender Application Guard](/deployedge/microsoft-edge-security-windows-defender-application-guard). | December 2023 | | Legacy console mode | The [legacy console mode](/windows/console/legacymode) is deprecated and no longer being updated. In future Windows releases, it will be available as an optional [Feature on Demand](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities). This feature won't be installed by default. | December 2023 | | Windows speech recognition | [Windows speech recognition](https://support.microsoft.com/windows/83ff75bd-63eb-0b6c-18d4-6fae94050571) is deprecated and is no longer being developed. This feature is being replaced with [voice access](https://support.microsoft.com/topic/4dcd23ee-f1b9-4fd1-bacc-862ab611f55d). Voice access is available for Windows 11, version 22H2, or later devices. Currently, voice access supports five English locales: English - US, English - UK, English - India, English - New Zealand, English - Canada, and English - Australia. For more information, see [Setup voice access](https://support.microsoft.com/topic/set-up-voice-access-9fc44e29-12bf-4d86-bc4e-e9bb69df9a0e). | December 2023 | | Microsoft Defender Application Guard for Office | [Microsoft Defender Application Guard for Office](/microsoft-365/security/office-365-security/app-guard-for-office-install), including the [Windows Isolated App Launcher APIs](/windows/win32/api/isolatedapplauncher/), is being deprecated and will no longer be updated. We recommend transitioning to Microsoft Defender for Endpoint [attack surface reduction rules](/microsoft-365/security/defender-endpoint/overview-attack-surface-reduction) along with [Protected View](/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365#global-settings-for-safe-attachments) and [Windows Defender Application Control](/windows/security/application-security/application-control/windows-defender-application-control/wdac). | November 2023 | From bee90b3e06b657af715f12badd6c1df691353a29 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Tue, 9 Jul 2024 08:52:02 -0700 Subject: [PATCH 17/41] wufbr-fresh-9153880 --- .../update/wufb-reports-configuration-manual.md | 2 +- .../update/wufb-reports-configuration-script.md | 16 ++++++++-------- windows/deployment/update/wufb-reports-enable.md | 6 +++--- 3 files changed, 12 insertions(+), 12 deletions(-) diff --git a/windows/deployment/update/wufb-reports-configuration-manual.md b/windows/deployment/update/wufb-reports-configuration-manual.md index 545ebbed48..5cbf3748b6 100644 --- a/windows/deployment/update/wufb-reports-configuration-manual.md +++ b/windows/deployment/update/wufb-reports-configuration-manual.md @@ -12,7 +12,7 @@ ms.localizationpriority: medium appliesto: - βœ… Windows 11 - βœ… Windows 10 -ms.date: 12/15/2023 +ms.date: 07/09/2024 --- # Manually configure devices for Windows Update for Business reports diff --git a/windows/deployment/update/wufb-reports-configuration-script.md b/windows/deployment/update/wufb-reports-configuration-script.md index e216694bc7..2d3b3f14b0 100644 --- a/windows/deployment/update/wufb-reports-configuration-script.md +++ b/windows/deployment/update/wufb-reports-configuration-script.md @@ -12,7 +12,7 @@ ms.localizationpriority: medium appliesto: - βœ… Windows 11 - βœ… Windows 10 -ms.date: 07/11/2023 +ms.date: 07/09/2024 --- # Configuring devices through the Windows Update for Business reports configuration script @@ -22,9 +22,9 @@ The Windows Update for Business reports configuration script is the recommended ## About the script -The configuration script configures registry keys directly. Be aware that registry keys can potentially be overwritten by policy settings like Group Policy or MDM. *Reconfiguring devices with the script doesn't reconfigure previously set policies, both in the case of Group Policy and MDM*. If there are conflicts between your Group Policy or MDM configurations and the required configurations listed in [Manually configuring devices for Windows Update for Business reports](wufb-reports-configuration-manual.md), device data might not appear in Windows Update for Business reports correctly. +The configuration script configures registry keys directly. Registry keys can potentially be overwritten by policy settings like Group Policy or MDM. *Reconfiguring devices with the script doesn't reconfigure previously set policies, both in the case of Group Policy and MDM*. If there are conflicts between your Group Policy or MDM configurations and the required configurations listed in [Manually configuring devices for Windows Update for Business reports](wufb-reports-configuration-manual.md), device data might not appear in Windows Update for Business reports correctly. -You can download the script from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=101086). Keep reading to learn how to configure the script and interpret error codes that are output in logs for troubleshooting. +You can download the script from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=101086). ## How this script is organized @@ -39,11 +39,11 @@ Edit the `RunConfig.bat` file to configure the following variables, then run the | Variable | Allowed values and description | Example | |---|---|---| -| runMode | **Pilot** (default): Verbose mode with additional diagnostics with additional logging. Pilot mode is best for a testing run of the script or for troubleshooting.
**Deployment**: Doesn't run any additional diagnostics or add extra logging | `runMode=Pilot` | -| logPath | Path where the logs will be saved. The default location of the logs is `.\UCLogs`. | `logPath=C:\temp\logs` | -| logMode | **0**: Log to the console only
**1** (default): Log to file and console.
**2**: Log to file only. | `logMode=2` | -| DeviceNameOptIn | **true** (default): Device name is sent to Microsoft.
**false**: Device name isn't sent to Microsoft. | `DeviceNameOptIn=true` | -| ClientProxy | **Direct** (default): No proxy is used. The connection to the endpoints is direct.
**System**: The system proxy, without authentication, is used. This type of proxy is typically configured with [netsh](/windows-server/networking/technologies/netsh/netsh-contexts) and can be verified using `netsh winhttp show proxy`.
**User**: The proxy is configured through IE and it might or might not require user authentication.

For more information, see [How the Windows Update client determines which proxy server to use to connect to the Windows Update website](https://support.microsoft.com/en-us/topic/how-the-windows-update-client-determines-which-proxy-server-to-use-to-connect-to-the-windows-update-website-08612ae5-3722-886c-f1e1-d012516c22a1) | `ClientProxy=Direct` | +| runMode | **Pilot** (default): Verbose mode with additional diagnostics and logging. Pilot mode is best for a testing run of the script or for troubleshooting.
**Deployment**: Doesn't run any additional diagnostics or add extra logging | `runMode=Pilot` | +| logPath | Path where the logs are saved. The default location of the logs is `.\UCLogs`.| `logPath=C:\temp\logs` | +| logMode | **0**: Log to the console only
**1** (default): Log to file and console.
**2**: Log to file only. | `logMode=2` | +| DeviceNameOptIn | **true** (default): Device name is sent to Microsoft.
**false**: Device name isn't sent to Microsoft. | `DeviceNameOptIn=true` | +| ClientProxy | **Direct** (default): No proxy is used. The connection to the endpoints is direct.
**System**: The system proxy, without authentication, is used. This type of proxy is typically configured with [netsh](/windows-server/networking/technologies/netsh/netsh-contexts) and can be verified using `netsh winhttp show proxy`.
**User**: The proxy is configured through IE and it might or might not require user authentication.

For more information, see [How the Windows Update client determines which proxy server to use to connect to the Windows Update website](https://support.microsoft.com/en-us/topic/how-the-windows-update-client-determines-which-proxy-server-to-use-to-connect-to-the-windows-update-website-08612ae5-3722-886c-f1e1-d012516c22a1) | `ClientProxy=Direct` | | source | Used by the .bat file and PowerShell script to locate dependencies. It's recommended that you don't change this value. | `source=%~dp0` | diff --git a/windows/deployment/update/wufb-reports-enable.md b/windows/deployment/update/wufb-reports-enable.md index 1502d549d2..157adbc776 100644 --- a/windows/deployment/update/wufb-reports-enable.md +++ b/windows/deployment/update/wufb-reports-enable.md @@ -11,7 +11,7 @@ manager: aaroncz appliesto: - βœ… Windows 11 - βœ… Windows 10 -ms.date: 07/11/2023 +ms.date: 07/09/2024 --- # Enable Windows Update for Business reports @@ -34,7 +34,7 @@ After verifying the [prerequisites](wufb-reports-prerequisites.md) are met, you ## Add Windows Update for Business reports to your Azure subscription -Before you configure clients to send data, you'll need to add Windows Update for Business reports to your Azure subscription so the data can be received. First, you'll select or create a new Log Analytics workspace to use. Second, you'll enroll Windows Update for Business reports to the workspace. +Before you configure clients to send data, you need to add Windows Update for Business reports to your Azure subscription so the data can be received. First, you select or create a new Log Analytics workspace to use. Second, you enroll Windows Update for Business reports to the workspace. ## Select or create a new Log Analytics workspace for Windows Update for Business reports @@ -69,7 +69,7 @@ Enroll into Windows Update for Business reports by configuring its settings thro > [!Tip] > If a `403 Forbidden` error occurs, verify the account you're using has [permissions](wufb-reports-prerequisites.md#permissions) to enroll into Windows Update for Business reports. 1. The initial setup can take up to 24 hours. During this time, the workbook will display that it's **Waiting for Windows Update for Business reports data**. - - Enrolling into Windows Update for Business reports doesn't influence the rate that required data is uploaded from devices. Device connectivity to the internet and how active the device is influences how long it will take before the device appears in reporting. Devices that are active and connected to the internet daily can expect to be fully uploaded within one week (usually less than 72 hours). Devices that are less active can take up to two weeks before data is fully available. + - Enrolling into Windows Update for Business reports doesn't influence the rate that required data is uploaded from devices. Device connectivity to the internet and how active the device is influences how long it takes before the device appears in reporting. Devices that are active and connected to the internet daily can expect to be fully uploaded within one week (usually less than 72 hours). Devices that are less active can take up to two weeks before data is fully available. ##### Enroll through the Microsoft 365 admin center From ed4959c2d74057378042beb2e662a08764869e25 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Tue, 9 Jul 2024 08:57:49 -0700 Subject: [PATCH 18/41] wufbr-fresh-9153880 --- windows/deployment/update/wufb-reports-help.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deployment/update/wufb-reports-help.md b/windows/deployment/update/wufb-reports-help.md index 3580a4810a..6e7c31a485 100644 --- a/windows/deployment/update/wufb-reports-help.md +++ b/windows/deployment/update/wufb-reports-help.md @@ -11,7 +11,7 @@ manager: aaroncz appliesto: - βœ… Windows 11 - βœ… Windows 10 -ms.date: 02/10/2023 +ms.date: 07/09/2024 --- # Windows Update for Business reports feedback, support, and troubleshooting @@ -52,7 +52,7 @@ You can open support requests directly from the Azure portal. If the **Help + S - **Service type** - Select ***Windows Update for Business reports*** under ***Monitoring and Management*** -1. Based on the information you provided, you'll be shown some **Recommended solutions** you can use to try to resolve the problem. +1. Based on the information you provided, you are shown some **Recommended solutions** you can use to try to resolve the problem. 1. Complete the **Additional details** tab and then create the request on the **Review + create** tab. ## Documentation feedback From 8618beacf64bf21e4251152eb1d5cf5b73588ae5 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 9 Jul 2024 12:27:30 -0400 Subject: [PATCH 19/41] fixed broken link --- education/windows/index.yml | 2 +- windows/hub/index.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/education/windows/index.yml b/education/windows/index.yml index 942a90b16b..ac12ab0836 100644 --- a/education/windows/index.yml +++ b/education/windows/index.yml @@ -137,4 +137,4 @@ additionalContent: - text: Microsoft Intune community url: https://techcommunity.microsoft.com/t5/microsoft-intune/bd-p/Microsoft-Intune - text: Microsoft Support community - url: https://answers.microsoft.com/windows/forum \ No newline at end of file + url: https://answers.microsoft.com/ \ No newline at end of file diff --git a/windows/hub/index.yml b/windows/hub/index.yml index 4b0d111d73..6bed7b9fcc 100644 --- a/windows/hub/index.yml +++ b/windows/hub/index.yml @@ -197,4 +197,4 @@ additionalContent: - text: Microsoft Intune community url: https://techcommunity.microsoft.com/t5/microsoft-intune/bd-p/Microsoft-Intune - text: Microsoft Support community - url: https://answers.microsoft.com/windows/forum + url: https://answers.microsoft.com/ From e4a32b2afecd299d82a7d7c93f697c60e747077b Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Tue, 9 Jul 2024 10:09:18 -0700 Subject: [PATCH 20/41] wn-fresh-8869747 --- windows/whats-new/feature-lifecycle.md | 4 ++-- windows/whats-new/ltsc/overview.md | 2 +- windows/whats-new/ltsc/whats-new-windows-10-2015.md | 4 ++-- windows/whats-new/ltsc/whats-new-windows-10-2016.md | 4 ++-- windows/whats-new/ltsc/whats-new-windows-10-2019.md | 4 ++-- windows/whats-new/ltsc/whats-new-windows-10-2021.md | 4 ++-- windows/whats-new/whats-new-windows-10-version-22H2.md | 4 ++-- windows/whats-new/whats-new-windows-11-version-22H2.md | 4 ++-- windows/whats-new/whats-new-windows-11-version-23h2.md | 4 ++-- 9 files changed, 17 insertions(+), 17 deletions(-) diff --git a/windows/whats-new/feature-lifecycle.md b/windows/whats-new/feature-lifecycle.md index 9c928556e8..578a92fb51 100644 --- a/windows/whats-new/feature-lifecycle.md +++ b/windows/whats-new/feature-lifecycle.md @@ -6,9 +6,9 @@ ms.localizationpriority: medium author: mestew manager: aaroncz ms.author: mstewart -ms.topic: conceptual +ms.topic: reference ms.subservice: itpro-fundamentals -ms.date: 12/15/2023 +ms.date: 07/09/2024 ms.collection: - highpri - tier2 diff --git a/windows/whats-new/ltsc/overview.md b/windows/whats-new/ltsc/overview.md index 881b172f79..5fb5127bcf 100644 --- a/windows/whats-new/ltsc/overview.md +++ b/windows/whats-new/ltsc/overview.md @@ -8,7 +8,7 @@ manager: aaroncz ms.localizationpriority: low ms.topic: overview ms.subservice: itpro-fundamentals -ms.date: 12/18/2023 +ms.date: 07/09/2024 appliesto: - βœ… Windows 10 Enterprise LTSC --- diff --git a/windows/whats-new/ltsc/whats-new-windows-10-2015.md b/windows/whats-new/ltsc/whats-new-windows-10-2015.md index 5679770b95..83b91546d8 100644 --- a/windows/whats-new/ltsc/whats-new-windows-10-2015.md +++ b/windows/whats-new/ltsc/whats-new-windows-10-2015.md @@ -6,9 +6,9 @@ description: New and updated IT pro content about new features in Windows 10 Ent ms.service: windows-client author: mestew ms.localizationpriority: low -ms.topic: conceptual +ms.topic: reference ms.subservice: itpro-fundamentals -ms.date: 12/18/2023 +ms.date: 07/09/2024 appliesto: - βœ… Windows 10 Enterprise LTSC 2015 --- diff --git a/windows/whats-new/ltsc/whats-new-windows-10-2016.md b/windows/whats-new/ltsc/whats-new-windows-10-2016.md index 22fdf02fce..df08af61c1 100644 --- a/windows/whats-new/ltsc/whats-new-windows-10-2016.md +++ b/windows/whats-new/ltsc/whats-new-windows-10-2016.md @@ -6,9 +6,9 @@ description: New and updated IT pro content about new features in Windows 10 Ent ms.service: windows-client author: mestew ms.localizationpriority: low -ms.topic: conceptual +ms.topic: reference ms.subservice: itpro-fundamentals -ms.date: 12/18/2023 +ms.date: 07/09/2024 appliesto: - βœ… Windows 10 Enterprise LTSC 2016 --- diff --git a/windows/whats-new/ltsc/whats-new-windows-10-2019.md b/windows/whats-new/ltsc/whats-new-windows-10-2019.md index 78cd95c0c9..6e5084a543 100644 --- a/windows/whats-new/ltsc/whats-new-windows-10-2019.md +++ b/windows/whats-new/ltsc/whats-new-windows-10-2019.md @@ -6,9 +6,9 @@ description: New and updated IT Pro content about new features in Windows 10 Ent ms.service: windows-client author: mestew ms.localizationpriority: medium -ms.topic: conceptual +ms.topic: reference ms.subservice: itpro-fundamentals -ms.date: 12/18/2023 +ms.date: 07/09/2024 appliesto: - βœ… Windows 10 Enterprise LTSC 2019 --- diff --git a/windows/whats-new/ltsc/whats-new-windows-10-2021.md b/windows/whats-new/ltsc/whats-new-windows-10-2021.md index b7f6c2c73f..f8a15b202a 100644 --- a/windows/whats-new/ltsc/whats-new-windows-10-2021.md +++ b/windows/whats-new/ltsc/whats-new-windows-10-2021.md @@ -6,9 +6,9 @@ description: New and updated IT Pro content about new features in Windows 10 Ent ms.service: windows-client author: mestew ms.localizationpriority: high -ms.topic: conceptual +ms.topic: reference ms.subservice: itpro-fundamentals -ms.date: 12/18/2023 +ms.date: 07/09/2024 appliesto: - βœ… Windows 10 Enterprise LTSC 2021 --- diff --git a/windows/whats-new/whats-new-windows-10-version-22H2.md b/windows/whats-new/whats-new-windows-10-version-22H2.md index 3ec8fdc763..a2c3d3e798 100644 --- a/windows/whats-new/whats-new-windows-10-version-22H2.md +++ b/windows/whats-new/whats-new-windows-10-version-22H2.md @@ -7,8 +7,8 @@ ms.author: mstewart author: mestew manager: aaroncz ms.localizationpriority: medium -ms.topic: conceptual -ms.date: 10/18/2022 +ms.topic: reference +ms.date: 07/09/2024 ms.collection: - highpri - tier2 diff --git a/windows/whats-new/whats-new-windows-11-version-22H2.md b/windows/whats-new/whats-new-windows-11-version-22H2.md index d2308ff620..a76a1b6abb 100644 --- a/windows/whats-new/whats-new-windows-11-version-22H2.md +++ b/windows/whats-new/whats-new-windows-11-version-22H2.md @@ -6,12 +6,12 @@ ms.service: windows-client ms.author: mstewart author: mestew ms.localizationpriority: medium -ms.topic: conceptual +ms.topic: reference ms.collection: - highpri - tier2 ms.subservice: itpro-fundamentals -ms.date: 08/11/2023 +ms.date: 07/09/2024 appliesto: - βœ… Windows 11, version 22H2 --- diff --git a/windows/whats-new/whats-new-windows-11-version-23h2.md b/windows/whats-new/whats-new-windows-11-version-23h2.md index 421552f353..afc12bea4b 100644 --- a/windows/whats-new/whats-new-windows-11-version-23h2.md +++ b/windows/whats-new/whats-new-windows-11-version-23h2.md @@ -6,12 +6,12 @@ ms.service: windows-client ms.author: mstewart author: mestew ms.localizationpriority: medium -ms.topic: conceptual +ms.topic: reference ms.collection: - highpri - tier2 ms.subservice: itpro-fundamentals -ms.date: 10/31/2023 +ms.date: 07/09/2024 appliesto: - βœ… Windows 11, version 23H2 --- From 08b09d9dea47c0ab86a19021d49334cc0d918d91 Mon Sep 17 00:00:00 2001 From: "Vinay Pamnani (from Dev Box)" Date: Tue, 9 Jul 2024 13:29:15 -0600 Subject: [PATCH 21/41] Provisioning packages freshness --- .../diagnose-provisioning-packages.md | 10 +- ...can-use-configuration-service-providers.md | 136 +----------------- .../provisioning-packages/images/ICD.png | Bin 60464 -> 29688 bytes .../provision-pcs-for-initial-deployment.md | 69 ++++----- .../provision-pcs-with-apps.md | 95 ++++-------- .../provisioning-apply-package.md | 29 +--- .../provisioning-command-line.md | 27 +--- .../provisioning-create-package.md | 93 +++++------- .../provisioning-how-it-works.md | 24 +--- .../provisioning-install-icd.md | 49 +++---- .../provisioning-multivariant.md | 97 +++++-------- .../provisioning-packages.md | 122 +++++++--------- .../provisioning-powershell.md | 32 +---- .../provisioning-script-to-install-app.md | 32 ++--- .../provisioning-uninstall-package.md | 61 ++++---- .../provisioning-packages/toc.yml | 48 ++++--- 16 files changed, 294 insertions(+), 630 deletions(-) diff --git a/windows/configuration/provisioning-packages/diagnose-provisioning-packages.md b/windows/configuration/provisioning-packages/diagnose-provisioning-packages.md index 53a0f7861e..dc6121f2d9 100644 --- a/windows/configuration/provisioning-packages/diagnose-provisioning-packages.md +++ b/windows/configuration/provisioning-packages/diagnose-provisioning-packages.md @@ -2,7 +2,7 @@ title: Diagnose Provisioning Packages description: Diagnose general failures in provisioning. ms.topic: troubleshooting -ms.date: 01/18/2023 +ms.date: 07/09/2024 --- # Diagnose Provisioning Packages @@ -11,22 +11,20 @@ This article helps diagnose common issues with applying provisioning packages. Y ## Unable to apply power settings -When applying a provisioning package (PPKG) containing power settings, elevated permissions are required. Because elevated permissions are required, power settings applied using the user context after the [initial setup](/windows/configuration/provisioning-packages/provisioning-apply-package#after-initial-setup) results in the error `STATUS_PRIVILEGE_NOT_HELD (HRESULT=0xc0000061)` because an incorrect security context was used. +When you apply a provisioning package (PPKG) containing power settings, elevated permissions are required. Because elevated permissions are required, power settings applied using the user context after the [initial setup](/windows/configuration/provisioning-packages/provisioning-apply-package#after-initial-setup) results in the error `STATUS_PRIVILEGE_NOT_HELD (HRESULT=0xc0000061)` because an incorrect security context was used. To apply the power settings successfully with the [correct security context](/windows/win32/services/localsystem-account), place the PPKG in `%WINDIR%/Provisioning/Packages` directory, and reboot the device. For more information, see [Configure power settings](/windows-hardware/customize/power-settings/configure-power-settings). - - ## Unable to perform bulk enrollment in Microsoft Entra ID -When [enrolling devices into Microsoft Entra ID using provisioning packages](https://techcommunity.microsoft.com/t5/intune-customer-success/bulk-join-a-windows-device-to-azure-ad-and-microsoft-endpoint/ba-p/2381400), the bulk token request is rejected, if the user requesting a bulk token isn't authorized to grant application consent. For more information, see [Configure how users consent to applications](/azure/active-directory/manage-apps/configure-user-consent). +When you [enroll devices into Microsoft Entra ID using provisioning packages](https://techcommunity.microsoft.com/t5/intune-customer-success/bulk-join-a-windows-device-to-azure-ad-and-microsoft-endpoint/ba-p/2381400), the bulk token request is rejected, if the user requesting a bulk token isn't authorized to grant application consent. For more information, see [Configure how users consent to applications](/azure/active-directory/manage-apps/configure-user-consent). > [!NOTE] > When obtaining the bulk token, you should select "No, sign in to this app only" when prompted for authentication. If you select "OK" instead without also selecting "Allow my organization to manage my device", the bulk token request might be rejected. ## Unable to apply a multivariant provisioning package -When applying a [multivariant package](/windows/configuration/provisioning-packages/provisioning-multivariant), it might be difficult to diagnose why a certain target didn't get applied. There may have been improperly authored conditions that didn't evaluate as expected. +When you apply a [multivariant package](/windows/configuration/provisioning-packages/provisioning-multivariant), it might be difficult to diagnose why a certain target didn't get applied. There may be improperly authored conditions that didn't evaluate as expected. Starting in Windows 11, version 22H2, [MdmDiagnosticsTool](/windows/client-management/diagnose-mdm-failures-in-windows-10) includes multivariant condition values to diagnose problems with multivariant packages to determine why the package wasn't applied. diff --git a/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers.md b/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers.md index a535175bf7..978aa8fc5b 100644 --- a/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers.md +++ b/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers.md @@ -2,12 +2,12 @@ title: Configuration service providers for IT pros description: Describes how IT pros and system administrators can use configuration service providers (CSPs) to configure devices. ms.topic: how-to -ms.date: 12/31/2017 +ms.date: 07/09/2024 --- # Configuration service providers for IT pros -This article explains how IT pros and system administrators can take advantage of many settings available through configuration service providers (CSPs) to configure devices running Windows client in their organizations. CSPs expose device configuration settings in Windows client. The CSPs are used by mobile device management (MDM) service providers and are documented in the [Hardware Dev Center](/windows/client-management/mdm/configuration-service-provider-reference). +This article explains how IT pros and system administrators can take advantage of many settings available through configuration service providers (CSPs) to configure devices running Windows client in their organizations. CSPs expose device configuration settings in Windows client. The CSPs are used by mobile device management (MDM) service providers and are documented in the [Configuration Service Provider reference](/windows/client-management/mdm/configuration-service-provider-reference). ## What is a CSP? @@ -15,11 +15,7 @@ In the client operating system, a CSP is the interface between configuration set On the Windows client platform, the management approach for desktop uses CSPs to configure and manage all devices running Windows client. -Each CSP provides access to specific settings. For example, the [Wi-Fi CSP](/windows/client-management/mdm/wifi-csp) contains the settings to create a Wi-Fi profile. - -CSPs are behind many of the management tasks and policies for Windows client, both in Microsoft Intune and in non-Microsoft MDM service providers. For example, in Intune, the policy to allow search suggestions in the Microsoft Edge address bar uses **Browser/AllowSearchSuggestionsinAddressBar** in the [Policy CSP](/windows/client-management/mdm/policy-configuration-service-provider). - -:::image type="content" source="images/policytocsp.png" alt-text="How intune maps to CSP"::: +Each CSP provides access to specific settings. For example, the [Wi-Fi CSP](/windows/client-management/mdm/wifi-csp) contains the settings to create a Wi-Fi profile. CSPs are behind many of the management tasks and policies for Windows client, both in Microsoft Intune and in non-Microsoft MDM service providers. CSPs receive configuration policies in the XML-based Synchronization Markup Language (SyncML) format, pushed from an MDM-compliant management server, such as Microsoft Intune. Traditional enterprise management systems, such as Microsoft Configuration Manager, can also target CSPs, by using a client-side Windows Management Instrumentation (WMI)-to-CSP Bridge. @@ -37,13 +33,13 @@ The WMI-to-CSP Bridge is a component allowing configuration of Windows client CS Generally, enterprises rely on Group Policy or MDM to configure and manage devices. For devices running Windows, MDM services use CSPs to configure your devices. -In addition, you may have unmanaged devices, or a large number of devices that you want to configure before enrolling them in management. You may also want to apply custom settings that aren't available through your MDM service. The [CSP documentation](#bkmk-csp-doc) can help you understand the settings that can be configured or queried. You can also learn about all of the available configuration settings. +In addition, you may have unmanaged devices, or a large number of devices that you want to configure before enrolling them in management. You may also want to apply custom settings that aren't available through your MDM service. The [CSP documentation](/windows/client-management/mdm/configuration-service-provider-reference) can help you understand the settings that can be configured or queried. You can also learn about all of the available configuration settings. ### CSPs in Windows Configuration Designer You can use Windows Configuration Designer to create [provisioning packages](provisioning-packages.md) to apply settings to devices during the out-of-box-experience (OOBE), and after the devices are set up. You can also use provisioning packages to configure a device's connectivity and enroll the device in MDM. Many of the runtime settings in Windows Configuration Designer are based on CSPs. -Many settings in Windows Configuration Designer will display documentation for that setting in the center pane, and will include a reference to the CSP if the setting uses one, as shown in the following image. +Many settings in Windows Configuration Designer display documentation for that setting in the center pane, and include a reference to the CSP if the setting uses one. :::image type="content" source="images/cspinicd.png" alt-text="In Windows Configuration Designer, how help content appears in ICD."::: @@ -51,124 +47,6 @@ Many settings in Windows Configuration Designer will display documentation for t ### CSPs in MDM -Most, if not all, CSPs are surfaced through your MDM service. If you see a CSP that provides a capability that you want to make use of and cannot find that capability in your MDM service, contact your MDM provider for assistance. It might be named differently than you expected. You can see the CSPs supported by MDM in the [Configuration service provider reference](/windows/client-management/mdm/configuration-service-provider-reference). +Most, if not all, CSPs are surfaced through your MDM service. If you see a CSP that provides a capability that you want to make use of and can't find that capability in your MDM service, contact your MDM provider for assistance. It might be named differently than you expected. You can see the CSPs supported by MDM in the [Configuration service provider reference](/windows/client-management/mdm/configuration-service-provider-reference). -When a CSP is available but is not explicitly included in your MDM solution, you may be able to make use of the CSP by using OMA-URI settings. In Intune, for example, you can use [custom policy settings](/mem/intune/configuration/custom-settings-configure) to deploy settings. Intune documents [a partial list of settings](/mem/intune/configuration/custom-settings-windows-10) that you can enter in the **OMA-URI Settings** section of a custom policy, if your MDM service provides that extension. You'll notice that the list doesn't explain the meanings of the allowed and default values, so use the [CSP reference documentation](/windows/client-management/mdm/configuration-service-provider-reference) to locate that information. - -### CSPs in Lockdown XML - -## How do you use the CSP documentation? - -All CSPs are documented in the [Configuration service provider reference](/windows/client-management/mdm/configuration-service-provider-reference). - -The [CSP reference](/windows/client-management/mdm/configuration-service-provider-reference) tells you which CSPs are supported on each edition of Windows, and links to the documentation for each individual CSP. - -:::image type="content" source="images/csptable.png" alt-text="The CSP reference shows the supported Windows editions"::: - -The documentation for each CSP follows the same structure. After an introduction that explains the purpose of the CSP, a diagram shows the parts of the CSP in tree format. - -The full path to a specific configuration setting is represented by its Open Mobile Alliance - Uniform Resource Identifier (OMA-URI). The URI is relative to the devices' root node (MSFT, for example). Features supported by a particular CSP can be set by addressing the complete OMA-URI path. - -The following example shows the diagram for the [AssignedAccess CSP](/windows/client-management/mdm/assignedaccess-csp). The diagram maps to the XML for that CSP. Notice the different shapes in the diagram: rounded elements are nodes, and rectangular elements are settings or policies for which a value must be supplied. - -:::image type="content" source="images/provisioning-csp-assignedaccess.png" alt-text="The CSP reference shows the assigned access CSP tree."::: - -The element in the tree diagram after the root node tells you the name of the CSP. Knowing this structure, you would recognize in XML the parts of the URI path for that CSP and, if you saw it in XML, you would know which CSP reference to look up. For example, in the following OMS-URI path for the kiosk mode app settings, you can see that it uses the [AssignedAccess CSP](/windows/client-management/mdm/assignedaccess-csp). - -```XML -./Vendor/MSFT/AssignedAccess/KioskModeApp -``` - -When an element in the diagram uses _italic_ font, it indicates a placeholder for specific information, such as the tenant ID in the following example. - -:::image type="content" source="images/csp-placeholder.png" alt-text="The placeholder in the CSP tree"::: - -After the diagram, the documentation describes each element. For each policy or setting, the valid values are listed. - -For example, in the [AssignedAccess CSP](/windows/client-management/mdm/assignedaccess-csp), the setting is **KioskModeApp**. The documentation tells you that the value for **KioskModeApp** is a JSON string that contains the user account name and Application User Model ID (AUMID) of the Kiosk mode app. - -The documentation for most CSPs will also include an XML example. - -## CSP examples - -CSPs provide access to many settings useful to enterprises. This section introduces the CSPs that an enterprise might find useful. - -- [Policy CSP](/windows/client-management/mdm/policy-configuration-service-provider) - - The Policy CSP enables the enterprise to configure policies on Windows client. Some of these policy settings can also be applied using Group Policy, and the CSP documentation lists the equivalent Group Policy settings. - - Some of the settings available in the Policy CSP include the following: - - - **Accounts**, such as whether a non-Microsoft account can be added to the device. - - **Application management**, such as whether only Microsoft Store apps are allowed. - - **Bluetooth**, such as the services allowed to use it. - - **Browser**, such as restricting InPrivate browsing. - - **Connectivity**, such as whether the device can be connected to a computer by USB. - - **Defender** (for desktop only), such as day and time to scan. - - **Device lock**, such as the type of PIN or password required to unlock the device. - - **Experience**, such as allowing Cortana. - - **Security**, such as whether provisioning packages are allowed. - - **Settings**, such as enabling the user to change VPN settings. - - **Start**, such as applying a standard Start layout. - - **System**, such as allowing the user to reset the device. - - **Text input**, such as allowing the device to send anonymized user text input data samples to Microsoft. - - **Update**, such as whether the device can use Microsoft Update, Windows Server Update Services (WSUS), or Microsoft Store. - - **WiFi**, such as whether Internet sharing is enabled. - -Here is a list of CSPs supported on Windows 10 Enterprise: - -- [ActiveSync CSP](/windows/client-management/mdm/activesync-csp) -- [Application CSP](/windows/client-management/mdm/application-csp) -- [AppLocker CSP](/windows/client-management/mdm/applocker-csp) -- [AssignedAccess CSP](/windows/client-management/mdm/assignedaccess-csp) -- [Bootstrap CSP](/windows/client-management/mdm/bootstrap-csp) -- [BrowserFavorite CSP](/windows/client-management/mdm/browserfavorite-csp) -- [CellularSettings CSP](/windows/client-management/mdm/cellularsettings-csp) -- [CertificateStore CSP](/windows/client-management/mdm/certificatestore-csp) -- [ClientCertificateInstall CSP](/windows/client-management/mdm/clientcertificateinstall-csp) -- [CM\_CellularEntries CSP](/windows/client-management/mdm/cm-cellularentries-csp) -- [CM\_ProxyEntries CSP](/windows/client-management/mdm/cm-proxyentries-csp) -- [CMPolicy CSP](/windows/client-management/mdm/cmpolicy-csp) -- [Defender CSP](/windows/client-management/mdm/defender-csp) -- [DevDetail CSP](/windows/client-management/mdm/devdetail-csp) -- [DeviceInstanceService CSP](/windows/client-management/mdm/deviceinstanceservice-csp) -- [DeviceLock CSP](/windows/client-management/mdm/devicelock-csp) -- [DeviceStatus CSP](/windows/client-management/mdm/devicestatus-csp) -- [DevInfo CSP](/windows/client-management/mdm/devinfo-csp) -- [DiagnosticLog CSP](/windows/client-management/mdm/diagnosticlog-csp) -- [DMAcc CSP](/windows/client-management/mdm/dmacc-csp) -- [DMClient CSP](/windows/client-management/mdm/dmclient-csp) -- [Email2 CSP](/windows/client-management/mdm/email2-csp) -- [EnterpriseAPN CSP](/windows/client-management/mdm/enterpriseapn-csp) -- [EnterpriseAssignedAccess CSP](/windows/client-management/mdm/enterpriseassignedaccess-csp) -- [EnterpriseDesktopAppManagement CSP](/windows/client-management/mdm/enterprisedesktopappmanagement-csp) -- [EnterpriseExt CSP](/windows/client-management/mdm/enterpriseext-csp) -- [EnterpriseModernAppManagement CSP](/windows/client-management/mdm/enterprisemodernappmanagement-csp) -- [FileSystem CSP](/windows/client-management/mdm/filesystem-csp) -- [HealthAttestation CSP](/windows/client-management/mdm/healthattestation-csp) -- [HotSpot CSP](/windows/client-management/mdm/hotspot-csp) -- [Maps CSP](/windows/client-management/mdm/maps-csp) -- [NAP CSP](/windows/client-management/mdm/filesystem-csp) -- [NAPDEF CSP](/windows/client-management/mdm/napdef-csp) -- [NodeCache CSP](https://go.microsoft.com/fwlink/p/?LinkId=723265) -- [PassportForWork CSP](/windows/client-management/mdm/passportforwork-csp) -- [Policy CSP](/windows/client-management/mdm/policy-configuration-service-provider) -- [PolicyManager CSP](https://go.microsoft.com/fwlink/p/?LinkId=723418) -- [Provisioning CSP](/windows/client-management/mdm/provisioning-csp) -- [Proxy CSP](https://go.microsoft.com/fwlink/p/?LinkId=723372) -- [PXLOGICAL CSP](/windows/client-management/mdm/pxlogical-csp) -- [Registry CSP](/windows/client-management/mdm/registry-csp) -- [RemoteFind CSP](/windows/client-management/mdm/remotefind-csp) -- [RemoteWipe CSP](/windows/client-management/mdm/remotewipe-csp) -- [Reporting CSP](/windows/client-management/mdm/reporting-csp) -- [RootCATrustedCertificates CSP](/windows/client-management/mdm/rootcacertificates-csp) -- [SecurityPolicy CSP](/windows/client-management/mdm/securitypolicy-csp) -- [Storage CSP](/windows/client-management/mdm/storage-csp) -- [SUPL CSP](/windows/client-management/mdm/supl-csp) -- [UnifiedWriteFilter CSP](/windows/client-management/mdm/unifiedwritefilter-csp) -- [Update CSP](/windows/client-management/mdm/update-csp) -- [VPN CSP](/windows/client-management/mdm/vpn-csp) -- [VPNv2 CSP](/windows/client-management/mdm/vpnv2-csp) -- [Wi-Fi CSP](/windows/client-management/mdm/wifi-csp) -- [WindowsLicensing CSP](/windows/client-management/mdm/windowslicensing-csp) -- [WindowsSecurityAuditing CSP](/windows/client-management/mdm/windowssecurityauditing-csp) +When a CSP is available but isn't explicitly included in your MDM solution, you may be able to make use of the CSP by using OMA-URI settings. In Intune, for example, you can use [custom policy settings](/mem/intune/configuration/custom-settings-configure) to deploy settings. Intune documents [a partial list of settings](/mem/intune/configuration/custom-settings-windows-10) that you can enter in the **OMA-URI Settings** section of a custom policy, if your MDM service provides that extension. You'll notice that the list doesn't explain the meanings of the allowed and default values, so use the [CSP reference documentation](/windows/client-management/mdm/configuration-service-provider-reference) to locate that information. diff --git a/windows/configuration/provisioning-packages/images/ICD.png b/windows/configuration/provisioning-packages/images/ICD.png index 9cfcb845dfab04cad5b040a16ec50776fdd81a89..c5525201f1931b84b7680a1f2bf21b91ba940191 100644 GIT binary patch literal 29688 zcmeFYcT|&Kv?h#7Q7j0k^deG31O%lEh=NEJfzX>oX`zRJlz@T?NQp@A0@5J?q?aH{ zkq&AIBs4(?Bm|@+Kp-$df8U)u-^`3cb~nV{X8epMuysF znYo$i=;+SsJkT_zqdV?MdtErmNc*Ho@{Tg?&oQvE_FX#o5brYW4ZX95fd(C2HSF~M zV+Pv$Q{E3O!E|)zz8t-d^>~#$p`!!G>1b-0KC>gX*$zmdAv47>bVRM^j3v^>KR8ag zy}u@SAs#4p-NE!2_XVV&5yuT?`^GzN^jbj~`QmRcXw4VFf#Vl#B8@z(AeQKQ$MM%( zT`BI7L?7PfM}UrZB3AjGUM3%0LLX>HYVY3`hJ7vmNM2F>NVWnE-yGf>+6x(6W7+o} z8mMU7#@K_#HrIzXk!SCoy!`UKa@2#)^GE-k6K0cnN&7GFM6~7^+81}1?g+8o`*X?L z|Hvh-UeV(u&>FUN4IZrU@Ynol0;O(nZ#uvOtSXTIl+@W4AbIm4c&oE5vt@c4IVdN3 zlMp@F7SQGeMz@`g4aJBBc<2H?F3Jt|SU4dvu>N>+4!w88@OhM05=guKQm{bklGmFa z?H?0et1L^uk{wYM!6EI32uHr*?Z;e$hMgHag@HFKnU>wzt4n#ldVe=Ma{|Q#2%s7% ze7??BeeaE?dyR)P*e%*ZCBcpHzzy~`DsPh`dOV5yl+l{^El%?b?l^w$5y>xR*7k4Yi*tlga*qR3&4)u%3eF}Ak_HC6#X>eRZJyI zenB=_pe|y)kyM0`GIk4Gl^>uc43tViX zL>Vu-q09w;82gI9{I*#0bT3auT?6%c=$dbvT)@u^_KE5N(uF29gNlL=KK4I=yaNeD z7-?!}WwFj=>b|-Bc#mQI!=j-Y&*FU!BF3MON!hqXL#V#1-FtfPbf9_$3Dh&;8cCAs zI{={GJj~8@l{P=Xa6XQYR6?NhW)z&V{V%>;?~0Eji;SP3@{Zv?Oy^M-ErKn>`l@rb zk<&q~w)W1or3C#0CMcNT@_F0B-!>^w0z{^GLn|-?iMB25pqACd_mq!7`_~qa`v6^i z7`;6+_`_NpoFQ0quwx`NtP8DRBLTEDcj^&porXAFyKgD5n8b=g_wTqzpUU>9)F62T zxmx|)nL1gFmLDK|65f%84ho``o`EvuT1)mhvNWh96JEZfo= z9ulCM9EWXy)-WS7<*wp!?rtWFp)U3+g%niAL((|eJ$GQRYsh*n#tyw8dSfBiw7h@Z zM;hsN*fywzt%qKNpn-Bf?ZMNVhm|b7$Tsan<=idEj6(TWT!=e0W*>F%M3BFUu?E7LlRFre5dU%VhkJnUGol zv?ZBZW!Tq<0^0Wd&~meHAhw0x9>BERv42g<>k)??8dbz**0Wl+7?Ln}EE?=MEV7qp zry`Y2ywOt+pKRz8Q|EZ<(d64#M1CA8i`v1}PuT<$lcGow>Sh^P{qd&pExibj0>h|! zRKk->*0yUU_|_yY#yYP(tA>)PrYEZkogZRzOIbcLd$|^GO!P}#c!UT0dG-n1%(>SV zSb*ZWA3_Gp){nw~woZ3F<8jHUm$Yg64No$2wpWM2A&IU?#Wf&ErZcnm0g-+w^ zA8Rct=*EDEO{XRxY2BYIIxwkvwZuh_y`a+l%#7`o)XM&0;-$eQ?O-YV!FYA0he~1n ziiKx+f%z1oJ1cF|*oiauhkvRKJ?`D^FN@#_AM!juF^;%tkNTd$GY>)y=krm%b8p%` zQupNo!-V|RhReaUs!)^i?m~D_=O)z{($T#zv z#{_sV`hQW3MTc0s*?#!at!%mhbjKU%&Vv?#rsapE-KujcDJZqxr@HC`K?1)PubANx z{N{3Mqe0~%P5RiPhqig%t(XIk%z$=*F9#N9LCC5?fo8<$?Lu-sl1t!=OnHCwAret! zU#YbGq2C#nra74!x41yWSKQ=G z)nHI)cJ?aFQjdeECpWCC_IkWdL17i;Pm-HC7{R%zM&YY#NwH<)=&#EZn^w;9p|vX4l^tQg0wCB|jpKaoFB{PD#Niq`A@w&acgznA zdg%cLbJlwPc~SMS;29^t&`u_vNMVQiG_Db{kjX*K%0(+vLUCxV%4j8NU1%90y4#5p z_Nkt?|4g!L-3eCFl+^r`fNCD^Cw0E zbXnlq1VoLD-s5bT!S?RQlYRhQv7CUt1+U>Xp;k0hZa>&QO^d~AC@C8AyB<_i(_8JOE&M3 z)4_>{5Yhz8F8-x;aCc8tWsttH3Y?Y##}Q*{b+|oWG`xRzRKfL2&c}=lrUX7`_0`eo zlN2}QN7R*}5uu5kRgKar{Prd9qBw&aLiy?`SyLME8#5m@m7{s^xWyRz`-|J;+ z89@;TV(FVd(>QquU&drh1v>b3<+1Y}tI-zdiYKWX@zFfLf4JbhZ*W4i7q53u7iGMi zoG3d888WCL?rTn9>Iu30gHLYCyd5POBXW}~hgtRJZ=vkWYAp)7jI+T=vRW;N0}_s3 zp_bzU_V0!&ICrEzow{*>0mwn>5J!CMt0*T}!N0~CSf&=<38?6&R43J;cTprzxpa1Z zQ&fn)f5$XuGCBkRZ)3TiDGPJEZn9SynB4D(fS$rv$wDrv+qC%)=r^6NldK`)s$Cf! z3HAX~gFUmst!BmO0!foaFFke5IS_^Uc>}RW%ne=3u_B-#8hFMpWCi`$HY^Mdm)Oli z+ZOv<0#%g8?EJH+jhUe$D4Y$CtLjqF#=c8t&Hb(B-Ua+(&(62hQNqYIgtKkO4gN>! z$_$%HcyWkuuIO0()$E&u$JX}8>u?q*zB&CAB#v86kjw)0dfCERq0JW-$6gM z(pnVjw-}UmOKU z3@gv+LpVT{4^gCBhJfq@_YmoYg3u@Ffi>%5q(U3QJ{hJmDqp6~4vjW-)FQbEw+wx* zOO*q!?vWM=SBb^nJ@sqXh;n(@29pJ}rr1ZuYXZuH;#bNRAHWUb62HBo!S^9s|0_Z- zhfF)pLUesUPGv-9S4BZjztKFC7vnYukhr^4aRG@PP3nBTtAiD%Az-CJK0VrP75*Ww zV$Ulx>6NBzS|z6ZjNNBzTHCboZb37@S{J@yM}MBHsz z9cBo6t=@q2C57d*E$q61bA+?Q>R)<<(h(o8I9Ia!iCU3=qCstkiBWlNF`6s4w1oT_ zmC>5l)o*`fXn*GepdskH!j8C#E6}_9-=fDaLkyu4mZOvm+VvktAHff=*hHiX6z^y+ zOBabGim_FTXbSlc39+{LCPXDfRay!=ZfXk2KNNPndFzZZNxsVdcdut7zhqA6h7gYm ztLw1n7q@jQs#YCfPjj>6)*9CbS-9^;()FQ{lZa7kExXn{Fy=1#h5e4gZWeOS+PLRnYi7N__tI}&+xij6eosfAxk#7 zn`F_y-Al1dO;=ca3QcatghDc`0`hBeVzQg<5G|g!!yBLO&EvdMt69dpol4MT=f)Ac z!_Yy0U7}m?$Kn9H6YOP_lG?$@*NX!&<-y>Ff}~kcN_U4Kbs63e)C47^|V$4Y8+A zR}qtg$2~WH^?ax`*{`IYTy({%>6M|4Iax9Z)=&B#4q%_w1q(T45t;NMRhcEA=7!RO zAUa>1U!)4nhr6GWl1+k)H(n}-)f#Z=uiYcwbv9vCmXrq~;>0d)NlQ=rRHwYM*dBEK z21A}}k2an8zTpcS6kmdDSW9o*wu8#3o0DybATFk< z;vpEQvPn)2BSTmzC%OL$;b_`jP1>{FzE{5e#STGO^S~={LhI&78Yb+3>y0Q}Z5#nq zi}anLDw~FmE2WuqU*+BI%e{?Aj+@E^ciWU*oGDs_o2!S`4MQ!l(!_fRWCef!N;y|? z?|4u`HR1`{Jivx*V7!(XqvXUt*)-`q^;E%(!{UU27Bp-A-utFaSuPW0t@$Sxuvx}9R9*s*q zDs|OQ&qD z*>5Ahl5Y-Xt_GBhO{Q&@LR+SJo)Q(6(tSC&f(wrl9jfHP(G zmX}=_#Qe#a{VhW?e|J#bn0aL&NCDsQV-5X^EKc@nP{PQc%WFqj)OY8p&2abQLnQ9| z>4su9*n@F3&EwjM_g6!vP2WAZ*o}Pn(5j38ZwWV0x;C*y>F+G`k9cub-VhM_etauN zZ)nigL2K{;fE=`K^-%wIw=_h6tJ}jdFAjq|hCMLczG5?wT{g&Bk^I7VY@nQPz7IXd z{eZjYyGh>`kJS(ZTxIvuw+7af+U<1OgB^D zh*3%z{<~Q#HuC|4qr5Y?K9t;drgGEa`oL4&&JNdk;u1~D%=@&Ex&m{J z@5YKf0|=P2-4GWQ!Q{369dbZsLC|o}s{_31_l!hC;FP4jijM7S$dHw2n zLMQ$v9BIP);oI#qq=x(`3-7z5L2;MutlL|DUzLw zi{n)C`T$d$%;~-ipJkj4%tU~L5xp1-bOGYUb&+FWhaMrTTvC%FGOA1|V}8%3so9C* zkc^*@mtNf#`mIBC8W?-&*T{XlCqXyzYfw!#-7Qzym89_5@><2VE7tX-U79Bz z0V3_PBnPWc;VQPhvIwu+U0dhr#B>iBiN#9%-9m0N5-5@T9rw%73x3dbZck7q^wvzJ z>~}~PFsm<(!nC|TBg-L~?33)zh<*}FY%)9w6lUrT=tr6_Ub1B(vq*AV2Bz7$3X98) zWw(t%Q|X(7G*^gXWu+cb7bms4ktXF~qk+Lve|M1QcDb#8jE(J0XjO)sG;#g=n{HRD zF$MKQY!7n5`p4QBMH1h?(@gON<6N+cFAvOuix!-rNI5YRa3K^6MM@Q)hFaRQ1ckx* z#&y%H*Qn0{5u<1Q6rTrPIYXKdOhL4~GG}O>%$ZKBpZ+l9>6f3eDqgt()|7>hFCM#-Vjs{{ zLB4DyoxRWhHQ2di7^ZE1zjEPpY#X8dUFMpse9-mqgW5in9=cZL%eJ_^gcf9Q{qhJo zFu?@rx!!U3xU0T?3!*X;dSIJfI+N{nbIj9kdK*w?x_)EH*)oELYw*te?alAcT}B5`W?U8v`n*v5W_47kmnRw z12_8V03HFjeC^AMhwmOb0lC!+;^f}rA12m8WZe(-v9=zbCR!Q43sOCL;y?1oaAjV( z5{lY1+UFB!Nbo+;lvVSGn4MND&-pk#RMxOgErAkIUSrj2?U#E%&4$*Vdp6s^M0ZH; zBqf9UPzaDZ+wC^p%#9ef02b<_hC_x1Mz>lQ4zz+L(F!|`9*aq?;xMo~uIJ0c;%Xlt zKLU|b56`V7&(#^Ny%-YZEgtRe8dI7t@z956APv>!L$4Unc1t( zu7-VXR`!T1uC5=7aSPx^5^wyJR`E7zvXXT0 zEHK+v$e)@KSom%xR9LS)_Ce=}Okc>YfX_mne8p)TwJfyn7u8gpzF!w)lkv0BtuDc0 zaW$gR);;2j48(gXB7cFZi_*UXy3#JGeg4gUeck;C+p6HhqtmF-$6qitWy2^vfFGOK zju{UHts^YFB!p37CFGXRg-v&;?yO$Bu)lbrnOST2Y=7@|f(Q^tNg|j$a}uC&?){(! z&6Sbp^U>ouKb}1=k3CEfQT+p+4J}oK9l^P9yA?Q#fLGi$`({E>+Y5}niaEMJu~ysk zu2cVD(~AjN`3?#7m7un91Ci$k1+AD@J}Y=JIVOl9xp4nOjH?$YjHumHT63F`vPT60`BfuN(O*S!Kc{6o)XYDkic!;a<^1FC4&xblbuh&}3i-n%A(THW9KzOm#2nys$9zwj&0vMjF z)d~AeUu-J`pmHmr;tH;7IMaaK#%(J(4*$tEihuc& zFLm=C6dB&V`EJub8wsMPHOqWjoII2Zy*R1FypMjWH)l#xsp7$#3}H0~cAxePSF$R} z4JB5x&{~i{w;s*w&w9Ry&omAg2v4Q0#EGCvy?)e94qkuI`Rg@cMo~rU6!!hJx_Ng_ zK(uy+nUGN~tmgx`R`-7Wc9)n?ezq4TasEo*fxpMuaW!2&_)N1pWTv7X5g85nfbob6 zt9&+zC;Qs^+gJgg4xzz<#9c_GNB!W$5cm!4aSKD9u0_4-z1vi3{sW?{0!@S{bO}D@ zbP?fRH!wC8VY;~|anQ`udNo;EtrKXRoBKUgu_+z=eKj$*WavTn%#Tz|nElKH-$Hyl znoK$mOE+j;@u@H~w#bFyb#b4oE76bSm;zfrACMvvDVNML<(v&!@1D#?`tQVB5S*MY z&fLj7rT3^Qu#|B!t~w!#=-*!E_1+3)ps@S#P}99xdYxB)rgl&E`@GA=9Z+8_dr}2g z^!TqJm)LY$cF(w%Zk1D%5L5G(T#|CxqJ!RyN<<}CRkfJb!3}BAf^c`Sid3Yq#^{D> zJ%tBr9IxIxD?uL4&P|W1qX2TfYF#no)2XM09UpyzBxqjG<-tr?X-n)b*LkScb`PXr z?O-K8^^$Bb%~sS~ID%5zYKsfjW(^5HT0y?QZfD=1OtVbfFl(l+^2+Y&Yk;Rb`E@F> zoClc1Tj;x3gr2bdNCYuF{bn#;*RIN{2R*M&=zF&|Un=X_p)}QA361vpov7e}hOKxd z*__G9`GPEcKV$5h`V?}jZL*iP6cG9W?7A@48w%Z{ z_osgO9=};b?4ImRsa9}E{iI(yxpcbThAVMBf&X!4elK#1I3B$IL};uu2LVS`_UZ+n zBhY^#WA~iUx&Yj-peU$|=v8Ai?%@xzp56BI6^NDxbqVP=nNUHO_Gf=k5g0RMk?#bP zH4`mGB#zNK{MvF%^jS>g9KFAe&bO|8p_k_|0Aa^q*68ua5L7hhW(+L~9fer2F^!J| z%*?Z*1}Qn*w3hsrmQX!MLKL5wd16%DOjzcg?Oj^xD!KG;+VX#2`um?X_y0Rtv86To z$R;v!+hf|?r&5LHAX-2#F5QhDXWyPiiP#2stU`ryzcz;s=33jJ5edKlNT1hhgN6K; zG^741q0aey?A2oO+tVakQ(-+rzUGhq-o8=2Pdz64Kf!u|Trd_FBP=+-Wu$oyEx(zmS*FNAm0ybTaaaQ{t7wQO7*^_Xz`0 z$AzhelYg~aK7{{%eA=OljF}2+=6??2`uT-f2z8q@rK{`KieTf_e`JM^CvK;H`4s<)}zVf1uwUBqh`o}!nX8M;e(gwozcMKE&HnZH-19&O*Uwm!02 zQ+r|J_$MEqCB(Zg2r3XiN(@?K~IMUY|fRh-HKS5q?70%9Yoqs zPX=zc4YKUxb6?7v{2BB>@fB@Q$*d@7Ab41BZLz%0Q+3nbq5XD%`hnrhEDY8)h)#*PRBs*Ntd=1vxwc_>Ok{Gc=N$B%k zKXhTg}1&E+by?E^x^+UTO zmpVG^rM9czb|Z9a+y117WI)(fuT6ex$V(rR{g{~H8Gr8if-DJ-cG6-t@?lq`@nMy@ zc9^@R_$GT0%$#~-uf2S&1DAggzxn9a(9|;z&IrLryp(tSb=@sH4E??(3IDw$2plvd53p;haSEeUg4uqItB`CDl ziz@^_o?LnCZJ24A>_PvW@~l>X!0VdAXZN%W++}{T(dLuM!nN13kG=thcJC-BB?hUR ziCF`v%B&K{TD}{>;Ciq?zc0o(JRL@yJJl@r@!Es8RBY~!+cOUy<5k%XfXh*!S_K!m zm9KO?v8Pyw$RdjYZ8#;S#OrNE%ppKeNHN5L!3 z`u#<1^{GhuJJ_-ebL5t-zEdS0TlpW)-Zkz562IsI2X zJm8ot==aTQ<&^Zajh2maRVh@6T;Jy)*Q1%_D?XZtnn7sro_n@P4625O z4_gG7)#tJ&rJStFdpH;b@g|MarF0viAe)1s?%C2WU_Rk4)Hqx@;L@1h(NkjWitaQT zZjgsfEny{zvC!6!O|BGhp5_3Bcj6YVuikv6dmYZ!U2Ojl3d709Sky4TMXw7xx&dLh z0&rQ#!SQmq*qJH@_LG%FZ(fEK-__&C{7=5WHroWgXSDJGx`q$cXWG|a2)<~PE6_bK zHXmZ@aZcf4fG6*okIj!Jm#m+CZ`H+9aeJDY#I~Le~Qf-!f~welT?;tmc_^TtE}HMv1QZm z>ulSa2zP)HR%Yi?q>PrIe06zXD#hj?hDRN+9B>xa^FThx@WL0G8N=r2CB(OzP)=!n zN^-{~Y`7Xc!z5r(NhN^^j@7-DxF=#^zWlb*UpFJH-mJ(;23pT)a*D~Ka!h;el7%7M z7+G{*ATGcg?$+;i)x4n`Fc|knMeQ=NR)w7E`ITerLCM+Cl%R+8}T#mTA;WoKdG9!{aJ*%Dz;urFF}%y_cbt%9Yh12pST<% z%3ZLz?>YLszUu7u(@z`~-Es9E-amsrXU9oXSFU8v1pP9bPHqd`>~D~t*}X|rSC`(e zoC%UoU4opYP1j5@PiJtl0sG$I+W>9P}-B6x$Dq1P`7aO8H|}p!obh zW}kX`Q^_n)8P)A#!LT4WLi*wp>!Z@Io~28RCGy*-T`@KLl%J)T+i_fGZ|Ko5rVhZ6 zwe_hatI?04(_zD@-|USp_OjO>QlxMHTq&Y0yiIlzp-(U0am5lYT6BJIwkpe*W{CzW z3}e?Ymm8VE$19A&E9lVzJ1F&29)ItkealvSNo=elQNNRJO!tD#LgPi7S53#v-U{wf z+c!*UnTuBC&ATf!2f){8&f@*^sLbC+#UbRiyrx1Ro9S0Mmj&uCE(pBjJDz{=*oJhX z#aLUy#Z27}tD}Bu+O9lgf_wr=r~OGQyqty}+Ro6zIQxBT$(+`7fUqxi{*nlM1f(bMrny%82n|73#QKGw%{MIcK{ zgtIP0m(+4cSctR3=W+*$9Ts{MF>J?Xvk>wGp|q&!9^d`JG2h0}X^v`RN+xA#R-nvO zxUP^p@{|^i3};3eFuwC0V(O^QqUX72;p@#89t~Zv2u}dr+Yj^wAAYx`-kSnG=jzjg zijJIx9#dpH*l6Qmfq#A^=IH-0pvLDjHZ~Y?J9WF^jfNUB35;cz39g`W0b|3*nV1%T z(Bh%aUFedhJI|*gyR+NJ3eL%Qsht!Zd|ztxqEBZlk#AF*5@ zy?tm7k&kdXH{J~I@ZSLB28m>#w$3^{%rf@AXthz#q0uj10489 z8;Pda&_=p+P=jQ?^+NYOXM}U*jagxoS9*)Xhwvyfd;1WN5)%fAN|};lE2(R09e)s! zbV`&#SL$W|k`MjjQ5=O?G2)d$e#ZeCD-l#*Pud2zQe7={Sm z>KJCa(!s=9stnXIs-h@TO+>gm@=!CQxO*9evjV9{MNI z+`yf;dG%+9$AMvg^UAT^oZR3a4CYE|b+qLiq3w{de>VRKA43`#I70n_6(WDpGt-@L z!WtuOi))jM?;Is4cV~mYw#RScIRDyCbMpA-qbp$|C*i&!_zSZuT1P${zUrQDTl_FX5nNiO&@> zG-uPg15l*mi#N0!bLkgcu(5BwiOKw^i*Xn{FZT8*^@fN1VrkC_&_;0BL!CDdf{_<6 zIe)qe&}+pPwSVsWnL0ht0<`@*xW&!RQy*vR< z0`|^mfJWAh^I}G0bJ62WYNW+Q(qMyp?*7iR)zwJ*wn@iChOoW5!MY`G8ztFd1&EPK zXUO#nwV#oGAWN}hLr&%=tCEGR=Q?*avc_5G==*5fGtrz8;%!TRd__a4m<|L@H6L#9 zoHWDbn}1Qc`@Hg~Yr>uManz1tzY3brbnot#@Zu3GY=G=-Qbi9I7Z3JFKYJVCSBCxG z&Dt{gh;IiWDPx1?3c2Fw6(Mxb?jehs81m}gPvASU!QDOeR+4Qp3X!ql1l?K)X$#v6 zswh~ETn#I;CbdzOdog8gHA^$@X0{>%bCWo?G_MW;dMQOyb#Hh&G+2dxtM zyH?M38|`0`7P-RTT(8N?vf6T8PiC;jmndl7{N$hMRWgGyBgVOeMQ)Z#wM}%Yv(pa@ z-eoFaqr)HQ@nt`D)$0R5Vxg;8bEuhy$d*EGz~(I(#-Zuhhs-Wz4}s?&0U!5>lkVAm z_s}+#r#9keOM7H@N6y@L^EeABb1)|j(vNqK7af{+__)v5>5*{rL6g(dlOZ4JC%?fr z^!oUfBrRLKsp8*uN=Xad8H#yhI?fgtV^BZ2$;+OUt~k2)e%tAlmG!-BH+3_p2}pAH zVOHAlK;k-|jOF!>vb(uF992`DC?DV`R@U?0l0i9)SXVm{H_7O6oeW?3n9PEaHtDV{ zry};gNs0Lnr}Er$8ZR+{nvo0JpMnYCWYf1L-Ax%RJXgC9&3lUUr?k@>;BAYTOJg<1 z#=JfR@_e=hXR6;tRSuUMSPjJ?1zevGZe=R8W3o6SFb(H`<+zR^9VLIrxEiyu7cL=` zLB)tv$npTt{sTgYxPtA|HjJ>vn^0xGwvsMv6>K~e`jkRBoCReLw~ml3`yek!Vw1cv zwhA{^i^6Pbf4LXtcAi=Y4sJ*L*B=sn9ksKT7Q+>N`~(rN+AC(HSA#D5oyIpQY&a6& zrE%h!hV35Z3Jwq(50|>7g;qBS6i3^XE&L+Z<)f(pPp8EpJG{cPf$!>q#dh`Tp=Q&C zm!|I@61`3z-&J&QQ9!Z7G>F#PasrS$A3Ho0$3pw+e!$+hr3|A2xpJ3byrL)Ea|$xO z@I0Xbt7F-NgV!{SK!cRR`0p6m`Mens7wE4MEV3=|pqn^&&#mo8=*58y#k;gTLgFOh znh#jT?pveatH7zlXkXW`(z-0n3^L`r&!-X3GBJLd=i=SeC_a}Bf6QxS-O2A_m$@ui z=57*ZSv|uUq3``8vr!o?Uu(5B)qeFuos_IzZO#WbYH+- zf5HcxY48|>f>!Lcx7jEn*);_DoXa-+H*w$d^TLdWvA#vIl>;w$w>=2Yogy;T;20F* zS|mlw=j}FBTde6{NLOs&CO7(P;;}r}ySd zP@5s$pHkHBe|7G^8R{oAW*DTb-0m}Iga%~a+47F`oAYHHbj4@T&| z*%g_IG7NN0rjKkbIMUNYzmc`p;4##|rICj8NW`EJ0fyC=r{Ev-4*HP11D z#3q5%Z6;!$&YRa(vt0QmwwvbI$2hw~gT#!H=iR(j5)_!K5lz@RMP$5tJ(E%t{iaZ8(ZQ1Gh4n*ezjBo+;DINMKt zQAbhJxx-s~EIu`*wNghdTy+WoZ8!gAMH>Ae-aswTA@NmQ((68vz0b-*=WBY$DkjXb zoyE$M+)oidABT^4D8L(|TQ&NkHtBnZ-+sPFU{~7H<4c3)o?bbU0@~v+rHkSv&J)r& zGbsMUiTpOM@l1Vyzf1cnSP20wA@z_Ho!he zBaNsP2QAv3E1Y{_*y(OLcdX+4uexVK{`yM}ytYiw7yhR_I-!DHhHhNozqj9LK$I@# zPml2L-lG2p-jb@@`A4Q2>H2ew;NN+q*7h1}%)zaTbYnV4T?8#T{b#QHQ~GAM`sRb_ z>b3(66c*{9N=w<7=;CAU{nO|CH*$vaIaj{q0;uL&aeSc$dsAbI~bk_V(xHdii zXi##Gcqa|%{nT9P&kVK;Qn0Ut5YnAb>@76ytp`vTz1r)WF4>@09D|kq=o2$ZJdrG6 z9-F_hz6))GCb_wXX21VHZ-}@*u5wU%h6DSodpD4ca2G=rBDovtw&boQQ-x^x=-rSxbrUeReT0t#Vl)#9|D z@pe8}$Nu539lI4D*O>~*cg6{^Re!{p(&z}t)9CTWUegg<;{D645#^6P-+EM= z{$U{D zc&Vk1H`G(Mq9$AM=Cdmwp|Rd zf)WuA89Ks=VYkNS`ZxRFKdo7hZRqZPRHy6?ishDa5Mc)gr}HWoR$*%CdRy;cH{b{T zl+Nf5Lm7&PW5=Cao(EavZRA#1i@ml;u5HD#DG5+TMXAwBhTE<^mcsdK{@1VDv~%>= zTj6M};0pBD>LWzY5}k(mwEWs#p|WJ=#ww%QRWEmTeUnV(SqNm@K$#ab0eYIKeM}s* z1Zz2VwbbF!d_;XJvmLufQmA={n26G7qZ5O?+DT?fb?}``&fIVJ6(jHMc>|UNgNKWe zmoT+ED(#yn(|=J8J}W*ZK=wqr6~czLwYr}Qv4VD#Ygx$+o#ie$n%8mwwJRXotE{wB z>7|N`G$MmYQgNg%ev{v2%`d}J2kR8jEpKb|)dkyOAsNWd*50g*B z%SYZd00>GWLGzm0Nf#FU=c$C@IONWguVgKIiE+hQim1N;G;s6%57iwNI|=frg=glT zkb+a6eXwV&1~9AuJOZwu5f2y>p`sJ6SC-By1bPr6?m}&j|8AUE5#@_`Uq7_7@hH~UE8bXsIAcFjs-Z!pkcN0Dn6G(6FSAjtY$ICpLX z(;v|3G;u3D3HwBOR+Zv=7*==e%N=02RW-r`dj7$6HU}Qa>H5%Mn-zT?f15cvP*0Fs zXg7@;d-JuS7p!&D^S1ZKA2Dx}9DzyfO?A=VZ&JLpwF4@PyHT&-DP^0>jdkVT%=qo0 z1+B(?*1Y~k&-;QPVqT~7hbZr`HqLZcVeP}&5<)ujUHS7?*sCRtU=HRg_KpFDGZ#4v z94466B3Q2dZUledyt!4!Y-gK}n_j|3g=0-WUE!39-`8onJtHPmgAT#M4t<{4fzv6p z^zfbFjadwtf4Q=ZE8n?6&YK`t^>iN?kOu7~fC{URu-)D^q{2fN->7@pe(o)M>)1F8 zMY(M?!+26^y>{le$Wf=22S9+eQrFXgjiM6U&zN)Z}y z^ckAlmay{c;ZOmAAu!ZPFQKhS#7i$LihQrd{*mJxpu2as{5RUv5x78ZGvgXI+a1fv z&Daw(lm|X8o{Uri%GOt(`#ZJds8gOMXQN-=Wnu(FLC*o?$De#PiqFk*oT{RoBnUr! z2Qu|V5kTFhR`w`z!YW3Gn8rGAU(LauoZmGnWnRR1C(udQ4<(B^aP%hDUs3saflcP; z_4$|OCQtBkwBG?QYAG1zwWt5ih?kq%&5d%5*)-VhfX#F*%Ec!t7d=RC_oBQ9{uJXk zBM2=WS}Fb`d>s1(@TJ*Jij+~Kkg&_nx!3h-g39a>rge!Yth@i1O={{O zVb!;~wkC7K_m`WHNYl3-M+7L<``S?kxF;mPZn}G#O&!4Rpi1LepPjc^Xst`WQ+iRA zfTM1Qh*KE=3AZ2bAr3#Y4|%?!F|8~<#~oY^#s4l!tUG{6BVd(i>XL?8IN`sZHVBGh zr_=LwqYa_lt9izu@`wqx?f|6mI53>5nK_hr_zGQ5>#_)!4e73TiPPLjU}mePFgeUL z@8TD4K6+lK?&cBp32<0aLFuq8EgbIF&A#i?-ls zb~^Jfr8Fy`bL0ZM);#1!VXP7}6sNJimMXLb`2Ii2g3QJD zlS(wNG0jPpgf70?XMK5KF*m3peg`l8qxlYh9kwn}&DRKxSGJqE{mX8&%s*N36Eb0z zg4Os#Sj&vO`zS(N#%HB2+A@Ah6Ut|~O6c3yQ8fJ^N)#ndm)94<0A4fozS=LU$;9n)c)TCI&%Oi9bIqu0Ftzg^% zsMNCD46vD++uPLUE`E!ii?(QgM&Oy6VrdWR(8}6flE_T;JZg4qBP6sJw~EfWMW(Sd zxwZ$6I+R>yZMpU*S>k#uyH2g!irF85#90P5aRt$sdqV!_Xv#s1mv8E8x?rORo%bJf zV*Vg1+*eu>C}g|JCd0B}CC{2!z5Zm5snnd88czMUT7mhrS}0+$Jaae+`&R(z3&sn zy}Iwfyp*>sXX>X1sD}%{JokKb1bL54lU@LHr+Vs)b^-f*>aTT;iNXSQf2D!}ozD6n zsspe1dzvdThIu^>7Ki@XOU-WfpOs-RQ?e>!kNMmk6!Do`n$v{$uPN}TZ}}V^M&_hc zKl9q$k89|W(IJ?^id}DVnkcDH%xK!FI2}Au(-j&+q*qs{`ER}_V*oFXSfG`c*5C4t zc`kcQhh!ai$q!eZD*IGI)L^Stl6~j^ie1@k= ze$8?ZfJsy}r8m;)PHDu?lAxg?{OTSCeY4{7M<;C+R6SRNkIkU64lucABuUB1s>c5( z#pJ{8&3VnNrJnNDFuVRjNpbBgBYEuhhTmL5PXOnduVEYrGKnRSKg;Nk`!>h%tJ*>B zLq5w@WZx;QAZZAoH;rJ!8(4=U!V89w} z2PXQNLYG&((vMVuNbb7(KX%vos?#C;P3E!fWv~Pm+4%VuM$6u5xFqB{u_UtyzBcaC zJJDSCJ^{%t=GTHbY?l5**{3z7LUvDz-xQ8?BYq%I#_cwNLOsAUUm?wEr@wjSIs}Hz zlZtTa8+p7fGA@;`7&PqqMIBu`#!mZaUK%)39fa#xSHi#bkgXb7uZJdzG}nl6INUV$ zROa0JfrM~ctFrhT_Enc(VHTt*4v*4~X1zG4$zC0FhS~r6{`dpSQ?tZSzMP`~ZQ2?@yi|VNwY= z;e?#>>5kp2rhzhv`FmMcdz_F4EzK~ zV%Lpx^qD)68wA~a>ju7#Mk^(icTeY z2M8_n1k&FX+~?f$p7Y_3d&ju%xbN4Dv9jizYtA+2^Zft6XWcKFJSB)6hHIT`i0{G5 z?h65oCWmVdO^hQK>@kN9X8m}l;t!}R^P#Acs5EQXVHLbN^YK#pIKsX6V7#*b*zLkU zKie_DBbhbCIb}pgT{**U8y?pDd$5%Zb32pnE+>RWe41#JizR)~g6DZxIrw#whwxmJ-!}TmsT%ld?bMkCl_iO}fYN zJ^cFrrPLq(gpAAjRnxfvFr$c-BfLlT9I!`t0mpZ*y&;nRK&rJw&p6rVC~)eR`-eGt zTnsp&*JD=+n^S-bKFwezy1+38m|h`M5wS`RUB)ZRUD zfCs`jhwG~59*cQ&PJFef?#Jr>=xcZ=$1_Zqxg`CAiis@VUoov-M@OrZ&;>cuU(+7&NzGZw3OWI4P-^WYq!v9mP5bi zs|Eu)aL3^%L%Rukrfi>&&K1ilYh~!@PI`G+t2+1_Tw)q>YXAF7D^Y6-gpX%=NaJxqCucJfZP0UX27W?_divY z{wEW+|Dj#|uf0oP>E96nhyMa1z%}>Jn^^)z{{I)_o1+Fe5))@6$Cr?k+mAhh@9f6j zy9~jTtI+^Ekif&uzyCg$1n7vUCtS|JG-s7X!z!<0NXFAj_cHXBam+4~1#F<+XScyY z>>>CXZLRHOn36htnY-Se249wLM-ruT2Nz6niJpumLvPtE@dpQAAiAv-<~=DB(CM89Xo zj2c7ORVLuUjHmswn+G?tGnW-bq{gI6SInR8wlhv9zvmk3)5yv{jrdRFr-5A{V3W>I z#deFx0wH~TKd&xAw>B=(%vb8MT$a4l5)O(cZO*7n-6Wn*xqqpK1{hCO$pdddw04qi zEA&7J7a1U*`2kQRNin%#_;d-7B>#+q6@qXT(N2${n_Q2i>oyrg|8q`O0i*Rh-ax9d z%6Nn71!>Cinx}BhNt?1{;O+UbS}J9(^6GIEOy_jap@P(oY4DIoiGLju&)Hdv}`Z4h@8Fqe_`HgRnE30J2 z1-h?uZeF^1ZP9izccWhQjwodGgf(*QKT_;}9v7R`hpb#jKk6fos|Hy<#rUprnS$8N zDr2j~)_JB?cj)klSy;bxl+co^TvzZ-E<$koUl4-t&5a668O^EB7hC925Hw?c6b2PlX0(;5zC=Y8}YD?NZq`=?8@L$!xyqIL(SaBq7|o?FG5JzC4noFu#;2 z(`YoM6St^llZ2N#u2?VnO@BjWvgYaX(Fm(4)w#EMW8V=q<+^^}qh0dHVwdY{7OYt| zx^M?)bBhm!9|4B&<3mBn+_q0nq}x}4lmc_;56^z{vh97FLOem{5cI4iRVIf|{1yJG zY3B?yuInE(g3(7VzEe;U6-v%T%yej*(Q_Slvo>x8?eGrj_08Bc;ocLEeaw zR7;eb9q9x6LFZ`2LlJavNfPO^x~Yn-^cQLl?Q!UP`2mG&?-SEF&1RZKd}x1{ zU6@bLP{{3rn4d%ZrlpsNFD+8MB(D2VB%&ggIlS%lzI{u}AuhzTyP$D$mza zhdLwgB{Cjb#@Z2Vs!gAt>QHNwp)$yB637vEd>j)IdR=thr0 znhkh!VV!5Bk+lQzW3TMTNxD9K(MC;+iC6h%^IkIYSpx-8tu2oTny{nlgMGIu!l%X) zBGUVFt3SAp{OG~W=jija>GTLppGNmBj{mXngZRu*-LF$+5&H*vRX7iHRVv*qxx{N~iecBlc`<4K$LRp?-@ zv+ly4J5!Dp2)Q($P*O&D^S5|#L8(f&^dzn zWeUjF_|Cj#ev4Kcx_TslTL<%=ZJoT+5O} z1ga+NWAf|#;c5A9-xKK+=^Z zprF~~BthiKZRv-rT(WigT! zm?0dym_60|G?C)e5TS<}&#zs7k1wC|iWZUhoPK#&;!sG5=S9KsS>)@&;LbYfg}5Hc zUuFXJVl$`C+jxFbYYnv=LfG;6RJIj39=rWvpojNk(6RIABYlS!TNyRRgtSU@$b)lZ zgHX-yUPXTUHc19wKC8Hj_j!#vmj~{g3`^G|92M-Qb)kPJxcf z%(z6)!Jwhc1bj+jyvP7!m6a)kgK4gjUWC5%t9AKZHYg_HjK1MBY53$N0hi&FcCpdM zq{It;ZT>PDD`&AAJZ!bqGP3wgpjB+<4`shJ)%hpRRd|HzA^jfhU-oIAQbYvV9J_3C zkiwo=K`)P}NPZ6#&n|1Ps+<f3*l>ALSPI#_e{h$Z7$8JdP;s% zQl18D@qvFq=dZ?m0O|wC>o5w9IA5mkC1XuI9A}b+;G6l{sm9ycwGaWGe;}YyqDe81 z&&~^KeDPH?)YX72|I-cYzo5{@7bE76)u8fr4@!}G(4#- zZ#BcI08G>V74pcQ>w9}2yO|L|P44&8y27Tl7_xI%8t}KQ%$FYt^h)=DSf>o5PVO;y z_=~Q>tHWu`p;~59@@q|A@5Nk2npCE=f&GSFMCI_+?k(H})@F&*BvY322a9(fXP!gG zl%5Y|rw1!@Ryg$8ufFoTy?7p*a#<}e_4(nAfvBT%0ja9SKzRFpEP3@=cVc*N+^LXt zA(lgOxXA?)As=LLDmII$iebJjx;4>ZqwSd%+$tTLI#ZQa%f!o_B9+%+Q>9LiC~lne56iU;?ZTdK26_W5kd%aw!J&Rh(UY zZuG5aDLeGYi@M5uqw^4GQZO!JwbWMGEP`0M^`(jV_%ZE9!fBfP11p03&*QsZN_8Ty zQD#nKL(1(3Hy}UKZNJdtJ{?~J_@O>dyT&eE?81&q1h|5!_Xd;fbDP?V{-&Lgqgt!-plnf<{UFWehynHZIX$IIh^v!aZ90)`?yZ(I~{m1 zxmk+zVYhM^W`o$*8%T$Y)z>Gw1;ST1Ow*Y++@xuIH$$YdG$m}b-+Tu-dUk_E9p==9>Qhh4L!%oFK*`H!~{AtXwQvyPSjE z(U!PSlJ@-Yt`J<`h0T~PK-sslUl-rVQ}j4XxSA^MvpDMdGe&$43?PB^^=D79yCljo zuTessJl)ss16uYRe9y7b`rUb8@Pf%RSbFx}uKjeGmnNSzJPCqbsYCSgu7+vizb}C~ z{qEOW|Ms(`F~I84rb?Uq^i{1vB3zjFICw%t@P@#ixiutb2V{%+xDIA-PD-7R<3^|n z&n-=NPtbct1U5dyD*cv@mv;FIKRSI5oc`C& zx%cMp+Gb7^${$W8S{nasLzDfC;0f@~k{N(V_j!fLP*d`6zg#Arh6k3OO{^N3JvFe~ z&1*T9$ItDyV`x1X^tg&Hm65Lb?DWOPqqKB>)>R|>*^;z355;z)@jcRq8Ivaurvfz5 zg!Lmrp2M^7P4x>wD88LH-sN%u{cI>m!ufFv?j-x%H9 z7&K_`KET}^MubQ?KW9`md}dpQoUwf)#lz?{~$Z|yBkTT=+*?s~>b$(9*@&f32DLK-?Rkn{;R_&IOPoRpTvN_9+#>FoGpX79G(T)0)qRo zaH<(W1kFcH&mfpWIvWW`8QeI(!cTa2BRPS3``5huQ~>I^h!ba2<;R0u*FS;E^WSi` zrJ5!zX+IYSkKu9Zdm`m72YBt#y4VuClljvcuv<;{pMhXG5b01 zR5b~V%|vUQXxvT%h(iR_IOgoy*p1x<$hVOUW`<5lw$Ctxxrv+ta`SEi=BFF=QcT32 zKeKnkw7-{)uuB5b<4XoNgJ#Sy_`lu<)&F85|6iMk`)@QXP$_m~H;Y8}{=P7L71tS5 zOWT;s%b4m9oE*_y8w*2}XmcJr^G5$z!4gK>b}K_1#J|=X6C@YP#nr)3ffLBd-qpRh z&#)FTK*&N7u9yaYL$lwPOii>!a9OBDy5Jg@s3Lzx%Cw5eoRRTgp%LSPJtgi}`ARv1 zsn9g+jTIF?KxUm~>}xIcVw{}h!*Dg%NH19+3zipCe6pofc#5lt?l~kVKO*I# z%`b5~@$`ZsF+woEYNK;Br8a&TSKyZ!Ff!Nzc6fMINQvKIdPzq}(dZC`_L6=8&q+xSD(a1D+4k)1HS!2W}4ayZ0!y?xpy%Igz+ng`S8VRcpTrF*0XO@Q$?& z{8xm^Y@q^aiFJ1YDj5iV#Ic+#TOB&u2tZb-8-GDobVJ>LfvkoP>u}(-9aY3U4Xr4-GB9^#oq z6tYuoO!q^MS$w?|t|nu`L3w!R2B2M#VJZy0_|K06kfde+ENVc?QoQC{M=(Uj@L1uM zD#uaAi}i2BH{&av%mw`T`Yjx;n%|Q^VQ#^;)~m7$AIZ;qp*1z8inV(pmc}lkqu654 zlvHwXuu@V_T4kqo`szFSo%oPCusvxJo#=1YkCe<1WmSb+2FyXzsK#GPX}=oXnM7|| zCU$q&r#=MA;=_f~#=P_w_*Kw>X#pwkqzAcb-aLI9kZRXK^qJ0PH9CItPl+`luA@B~%7gnM3ERxOSIs@{@gdftL;bM+QbCfaqr@+Umynm65G zN0vUPi87DpTYXe|m8|VI9N3wFl)}Aqp7?|scCB$NRmfpP0k5@6y2~7VYv9$wWonSg zs<$sXD;4R8x3G_1&od!vyb1;ft4CN3Vh%F~9cn3`ect&S5s^+-3$$utbv?li?!F~;(W?q% z=7mHCVq0KDcd_VY+;{u(aehO}V!MKNI+O-i5iIsq8m`LIdfG7MPyy9y*Y}k8l02zDh&gdw*t~Yja)6J4!JaAVF zZXBBc1`fc?64h^y{Glj;xDp7uRUPvW#H^7=egU`RscGm`RAuW4DN|f|_CO9JwHm=B zJ0KU`q1r{hvatQ2Op)MVZ|3(8nCxC2U@GP|Zf~}{`;Nmqrvj7Z%G9LDD9i30RtHW}eBwz3QAT}&Gbv3!6Gq8BE zKH!Q3ug~gl@IkNdUv$F~^ugg8JqE4v6x4dylvq+=`Bb~lcYH-}{7{p?IU!WIDcuty zJw!T3&+`G&a3Y&VMLBIrMlg?#*yoNioi+?NmPCS&q~!FD(G`#78oAh!2VBz_sow>1 zOLJRa-4t(f?JMZk;w=kF+c*n3X*J~7P0CR|>*db)94%ZuNYzsFt6m!~%iLfSpl*NzIWDwf!a?2;5H?TKLfiue z+Zd|!c~Xd8RXZT$c9Q)ugp|bdh5pM+qMa8jwNB`6<=J3|?7IV>uSzV?Uu;eVJLc!| z!WL=hHY{5d1ifIIg)C9Z~QjeHZaSpCE?x5dXAWIYvLfP#b&spBEqXv`Toks zW_&~uG;7;Y2u1Vq86ncc7m*3j(3J`}^)crpk_+Vd)OlNC%DVX~41Kg)7s{aZ>*VV< z#ih&X8=h5#JL|);jVibXWxWSy#$S$ofN#O86V*RXG643WZ7OUCP`jCm?A+nsoHH@HPS zBzTj5d=NSiZ%%P#^$<+eo!>rG|H=~}x@CAB3v%OK1?EmFNCdCH1-6Y^DQ5Z1PR5WrjEW}}RD8kYo8irX? z6G!4v5QYQYVtDH7i&x3MgdGb|Bi>%g#!ZU%ep_v<$5yKon9UtX;9E-kFC6E8?~u?w z`JP*H>*GF&fHuAqaHiSS4_f<^@ORF-q#|Rc-x(ss4u5y&Rwi-CD@+KMcFDNrRMaqa z0t`#SKag?Rcv(#m6qFF9S8kgwo;jx~0L04E`*JMW&Ipdjl0jK{0{=Z^u%4r5g6=5I z6A%Jxkn9%n&jvIrSV)aS#pO4I)#J5`6oepke!LRGXuCEpa%kJzpae@+f}8gR%$#d7 zIWmJxnzp*;#0xW6-U3S5t2%!~iP#SC9!FW06n6z_Ez1DOtrNf*dt~aAVB9G|jXc1-vFgVBlPKCIR8``=bqOA%8QdY49fano(%;IPG(<_C)i4>kw($?W=X zzRPnVnw5!S6f@&30n_g~N*vBWMs&;8rxV5C+2+d>v*gU@y5V1f`rW-Ah*LHtS(&ha z0M6Q=_}eMZOZK48=i&DqrT`HvHac$gYEKa-`0W+mX6D!E7X;m`qK9a6_n|7uP4u#= zSs6z%l)Z>b5B-iS$jq-A2*B1Z%nhbA_6M*={b8@dN-)%~gI9P%eeQoU{jA)dnwNi% z#p8A1g1why>QWum68myaeSor%zi|=ITjvMM4?OZ{9ou1*J3~SJkv6n+msY{DV0^$f zTY%qhoJ8IbQj|RMjYDWlg)<)?5jm@q^vCRS;mM?D(Z3{=wP}2L`u2d-;mddT$K8@T zhbxarbGF@=&7abpsOWr?um~bq2bC%GD}H@<1=da+DI#{-6%j8FSh9<>O(y0YvLcSW zP~OVSQv6C3+O9Qsj}i?SG|(a}%(-+nY!#zlFZE%ERZ#J;y+AQ0Wto$oB)a@_AH_2o zz*3}Z$ix~qdMLJ89A}2CU*QNX)zxY3lu~a8umpEYp^BGN+xwed3 zj5Es6cF}dHh@UHRyP|=&=`=uQf^P96?Dt_c7Sd;GFPwa&GxxeBHs@ADHeCIkv>X3#Pxc~~? znxQ32E23Ay{1WoZG!m3tAZ$p+-X@>|)klJ$tPY9Rzh7nJT!wRiBae)b;my+p9LP}V za-)=AZNK5MN=PjIz0%3RM=&xu@OJ&)AWf81900ZP{W5_#m9Kdh1c zH!D%Z<56OnN&auvMlaVZVUgmAONnvM)MZUTui(VTF^;l=mMl5^cRN~hWHZngmIP2) zy{cOR_(H@dPB~>|X`9=Pc2gfMqQ6(}j@IZ%@Q0}~ykDJd)StTK@!Jh3_jbrZQH<~N zu`mH=QNXAP88&-L2B2-In&BjCXMEvICso|H!FUcGI#w?TJbJUvhEmultn!gs@R zl1`Q!NBsKaQT0)gX9)fzWxFzHsU_^ld6-wkZ_SnD`{0PWsYCEn~z z58w(D*MVIcOq@N|R^RSJ=(~F_XInq_gj-)c9QbCI@f90;N^ycAJ ziv^{sVW`JA&KAb}GKUiPD{uE$nqT*-)Brb|o`KMbbLyxi%^?EYqedzcxPG|R>RUsH z9qY^ZNF&;*5$+8>(-*Oi`+xu=sz}VE_bJf8L0J`37N<p0Wumi>UOB;_>7yh%Or~GzX%Yif4FN5h-4bn_1{H4+N;Xj`CHHKb67@gZ39U$rFT90%4_dxT7Qrgn_vc*Ne&~|l9 zUj~IT@c?r#`!!JfAD=jRo6&UBu+P4d`UZ|aS1F@{fk}?z?Za|IA&bOe_0mNIy(VHv zf#C|Pjc}|1K9(0sj>~VhE4k7T2;QXi@D8gxXmxqf^p0qryJz=OeMijR==}Q=11XL5 zhxzwZa5EGQyff(mO!M*ClY)^@046pDN~PFv-@n$*+BciaFor-u!hin#pWyNTMtJ@I z`6c+`pLI%4J@Wq_D)IU6Uz+*18x6Q^a`q>FZd6QaH@XCTt#gmj4O6|U>(0;q5AggW Aa{vGU literal 60464 zcmZ6yb95)o^9CAcW81cEV`JO4ZJQh0$tSjLZEV}Nle_QtchCLf&Y33U`&733t~ps}HWfPmnBONuH10Rfl(D|5d<{#~hIjiUQ^0CrZA5C*E5#y$I20W%kp z6#@dPkB9j*1pilua*)(?1_FW~{I39y+5=30fG&oAiwdcD=w0T38!U0}jBFh6ySp3W zFuMG8z`MS_wrT79Z?kXviy3VDck3z}FRev?-5E1D&0D_>V;e!kztx@8a=qB{KHGnu zJd{98v=0$FF(F~mh!RywtR$g7-CwXnKg@_SN+n_l{rLFyAR-)AG;9w^Qc}{2ikAFf|7ipLxKtK< zQN6NPq#eiy-~BV@t&^h~Rl2w%-#%d6OqbJ-n~_B`e((*89Rn^5MS8LXPxuogi^!@O zAm#J)J&CnIp&Wp{?**BJ)1Ih(wZ({8%7Uqa{S|#{zt&f8!;bU$Mf}-o=K_IZ=FG$n z`ObwCIyhYWtM$YHvlIje9kWjG{+}?CevE<(g63~90k@}a{uHSB3EULd5E}wv$-KzO ze+Xa;Y#76Q*~KM10_k42oWS8#h&^`FewWl)sGtU;VjmJj<5PK(l9CEw!iP7W>?-!A z;$^j*Ds%(iOgwFP=+w~9w+e;sDYX|KWmp53)g(`#-bhh{$m?3Ve?!2n#&l5bjOt6` z7uK{FV57m}0>Xl<`t)_P*P&C!S$3IR>>x(R1O>@98B+>IPv!uq@bNQ+Usv`}q13yM zmOmrh6#287VL>;Qg8Jau;WOqxUHSs)QY$BpJ#9MJN!4X#_W8Bu286q_y-bej<3~7H zw`(rc(UT{PmL0qPz$sEoW-${651xN-XuvR!pWNZ7ShE=@DTY_a3fapn$J|Iq+lJPz=Y6_|JCWz6QcR&3e@C zBd}W@2dd5sQ~3=+qxMAV}S=t>p877qQq1Gdp}aV}V1kiutxVp|^9 z+*-+vC*MH0V+$s{(U`rQdK9{xUi*q}Ccl-QC{@BJi*{n#$5T#w75Va&_tR0XgVUhf zc64K{K&F-NecWpUH>CaJ&Vjp&P(@qP8>A}cB4Gmhjm@|Cwkyrc`r@{-*iJjIY~MHl z_(3uA`6uap1AcPO6%APhC^}WbW;3$8yeqw8`840IDj)}CG#Z^u z0=xy&)N;HaTH(&QUYvwVGVfb4KptyO$Cvd6pHsfzDYAMwzD0B`}GM!ho*0iX@=#(=Nt-{WM^;>vi5Lh z{%$Xu*%L2bz%QP6(V{T7wz8He^XeP(^EVS3C#a=PZy@yX<_7r; zK%pY0r^?Rso6Ma_-rh~|+Yxx~>d$w5$=La71kRMR#=%adPLFLKVS?~$HU>~ZpzS&d z-U&S1p%bL{Rkbt5id3ll;eH>VXX-}@__DS;rcYZWB5Od!;RT&puO(Q&EFv~L zuDUwS$uXr-35g1Q9&hjas|_3oxR#*mEj@%8BL+urc*bBTRiI_v=`Lq(hG&3I@uCWo z29Kw;8ydW_8a=>YKVmB&5pO*^WcyaYeFgFfV^*t<7>t^>;S?PqXiJyB5MHAWfvH$b zgkq~TfLn0uz}Fph*t;exRf@yBj;5ZVy%n%iEr1sUr7Kgy@C(&6z#-N~N65#|pzj8q zTtu}W8WHw6ZRG64xi`uR1QP{lY)rZmbg{j?u1i62$e+qDHVn5KLFlu@MoFc^0(Uy) zy3zHk@@Itx4Q9(NG1R@9FXy{tHxiy+Fnx+JI>ThzGVSvzBzt=e4OXe3B?vtIJ1&;P z#Z&G`!X95>F1fE}rPK9vx9-${u}!XH$p)A4)A<0>2LZQX!z(@wWGiIsIyI`ql#H16_iW9{LopdUA80J-#D!h+6t3WlTwPt z1lII2CC56tCtD59(d@Px)g8cxQGrL*+5B!NnZvS~%>+G1^dZ05>Ga-<&mH6ANOI8^ zo~Nw5xq{Cyf`Yu*+#FZ8vXpot(QwdaZ+i|^ zeK~3j2euzqy?v48crN&Z?Puuo@nuxsP|xm-=8SZK#(S5<6t5_a!x(ZzB5 zXYLJxga*Al-5$?9(lFs+i{(3K;^5JmjW1DFq^hbZ15t$_u49YiLYbc%XK1?|gdfkP z@72PeS3LC6ZkeSu;+_SLbbn|HTz4jL=cAVIB_);dF>fr`9)Z&)}Jc zB)jYVmUCgG!-GS(b0@>sWYEPjJ6)9WN~?vvx>wN2Q{0ar;=qi{q5kR>ev?eovt+HO6hAa!<7hsu@w@iHv6iI8<$$c4&cF#1Twac@$MBZ-*l=+Y64W#e1J{3rlCbS`Nt;O| z0nPo#wngE$YDxE$#r2iP-K=Sv5DtreF8Fqhk?t3VOwJL$ z8{zlJ<{|}0qbPNG0=L0r;$ukqYWXD+j^3T@9LhuLx_l4%&;GIngW_Gd5q2yD5p@Yf zkrEZQ=2E9{e?fSCfvgmRj&E5qh20tk$I0o}5KSf65micqysolnHG9p%k(-Rm`W2fe z(#cK=Af5H{uB2>GPHYtS+{JE*EQ8C(@0#{YQGL4y9>JEHL52=|1i_D#u_>y-4%Lh8 zWoZm`DAa&bya=tAlj8>D!BNHIa1zpZZ{s1Z$NUx(%N}_yzx;;8jZtqi?vL|vmCp8Z z@xt3=7N{*Jb31AgV{*w{76JtW-y7lGy_2}2QVKHYM8zK(#aTTn#tOyYLJ$t(H&eZn zFUVGTD_W|s#Kb{Z{LT% z)OjHEcj`Dm1F=vKJzvAmPKxwxtQ)-NOwZJLdNGO1>bh*-{y@u)Pr^(R<1sI6qj#-+ zx;<13O)QF4-q(=z$aXbvqAFP}QWFzRm2fSb1v7NV`ZP6>W!|$RZ2p3d;q69a`Id2c z+)fQo(^1nDR9CZU&UN4xU~~JO|Je6d=7P@lCg%4N3~4TFL7i6V`uhi0kRwhw(A(vV zwax$L+*YAi&md{SFzLS8S6BLzP|>GfEMSwDHw*`tDZfeAxVmipEOE zCHZ@;1!Zw1rx%w}YwWzQhoK3n-Ld2-s)trWaV(|vv2p}prTl(Ig0)sT_sZ#PA55vs zXsm7^?Ik=BYdD#`PCfDr1$j~X-WE@gdft^2E>gT|7b6QDcIvgeqP*EhgOANVQY>jW zENJ#O8m9vIrnh4=bs;+d4|eYA-0gA6Sf1^c2{p!>p8UvGdP`Gs>z8D~0+?=Ii}747Dz5QF{h~3ktLXFNXb`238-< z%>krQ%4JI4lFAbKk5baV}O-%U$K zMIXm;x1W*n(XR=r>h{(0NdL{0+8L0km#;8x3f@JYu&t(u%ub+R~}NHL>& z3mFc!X9jhLlF!HH0E7``A>)hvemg5wzu9EyaQFva&2Fl-CxOu*R+uP-CRyn>8sIP= zRB5S=&BBQTGewHkRpLVLdvZVXSpck`;jhn|4JVV9y(rfUn@|YZ;&oi0+IH7 zE;iIzHj4AX>S)12(oWqdbA*4H!{oPnh*4)wA_Ck0AXXwhPt0=hd}X1Ps%~+-Rg>Ep zh~3Xho#MaKqc-o;VhkGGP*s6Y|Di{gtH(GtRkjw=-3mj4iWro+Y<)T`R#Ch|f%^j_ zd`~HTJd@33YxKl!{Z4wTPW{F3rwk;e!0-#av2+GLN2hx#kFDC%fMv;D3O~vao%ed( zpckq~Z&=B*UZ!WLcP{LB>iaGvwpJ1!M6nwH4yk|mw?qB3lg4y*IQw)wR~TH){{(WR zu@$ChV^)91 zQ0RuB4q#inzh@N%25s+uf)NFQQ*cKHs=?SbfIY-&C0!a0Z6~DurbdggSj-D!Hh{qK zT`IVM{sEWRzrnkiTa_#yA;{lbi6*ENqWq;oFQY7VcR{v2BV0-FSQIfaTbd%aoTHHv zAj0dDKbzk6^b3A41!E>1Tg*U5Eg&LblF+Gq-s1MY0!pT!A{ypi=-WX#0OYSVF=jG- zXqlx5Nj1Y_w;GvnXEqpD|?4`^HSz8YJNH-~+)PH0*To zQ5*qE<$bjvUaJ5N|3nlZ8B;~FwR)v)K?0O|1xAPA+_4Y!!CL(|PsiR2L6+;&sViOB zktTchp6sA_2#`6H$oVDFH;W5UMgCn#@Z-@sdOA7J-k;?W8OWz3!+k?%H6T zn*2cTJCOFVS>cE1;`)NJSHuQLamXd5Oj1*JbF0@Qp z7@VK6QQMnI;-e}I%AZNN4auYwfd>OPk${y=NJ^k2yqV^y-}iXf>NUu;BtA0Fm_ zu)qv*AWWl~QJ$)#TNu6y4fThBW^0xsdvGX->POL(tj|fe=J|#gw0%Y8;XGnVOL>@m z(_O5Ub#eNi>0!sp5y=%^0gSLqgblZ=$|NoWqu0on(WwyRi^-(~g=kyBBJya~l04bgzmkxl&&Q1d*)VHdr(u0g4!7e4qt^*3FLmq4^Z zP}Fs}68w|55BD=8xgL(e`)?h1f_qlS2*{3Lr}YB|X}yL`>EU}~XG25!0Yh{a9IW;d zl4lYSG=ltZ+vB-;TDzMy7ZRMx?6R_b6c;XV45@5Pa8p1Ntev@&`O&+%6+R6Q|GT9Q zdV;yb78~+sFnjX-B9do5K8d$3Evgt%$?mzP`QNHb4DvSB2R&fkZ#4J?%(tZzR zEM)2G7*BUoNuM(CVzJg5W9Y(+hCu`euG$~U7R5xegw$jNR=*A04bbXyhRk230@4T~ zVi>2$C()I|42ze|N?U07aJfZymVeYIBjGJgUBzMIHRJd&vRdP=#bzeh&03>j)Ao3o zTXG=oVSDU;zA`#lrctiM0&A0Fftv!&)bL`$6j(t>3n~pMO~1ix@ss&kmxy|4xhua}uzL)Nyy_Ez^`-HKBfymj^sI5UF$8Dznd~U%ayf9dfa@wmPe(k^BNpYeVu#cF{o<7eVQ))9z+uhjm#+S`$& zS;Dw6GM5M!gO_Y|wm)PhB9(lkF`5bf*AR@o@nNxuYVG+7z6$UQXOn1=*Fw{}mz0aP zdOpw9M`+4|@#^Pe_$6+dUk}B#~a8(3BY+ zrV8WHs;ITPM2s3)=mb{yqmhPKwMAbcdS5}L2-S-D23&!nedkaRSISb z)HDNRw^;hf(L9%)TtF3Q6La;7q!(`I+Ng8iI;b zB&rEWX~UXKiVj4TGf<;V8}a%b%P@)hu2thR|@hLYt%K%!jwHus&77pzq0) zGPOOa1TZO5;|#QMo+v*vS{zwZAUSq9CmTRZV-Zs(v!}o4sRbb6_V@S9Osqf-tE6bV zpH82Kpp3tj?j^q^F>U;YT8JjEBQ#ML$K6-|nC8F+F#0r4^rJ>~SZ#b3w6b{C{aLY_ zkD0Bxwpy!wEXIEU`)9eM#_v#y3@cgC-nEYB(j{&ezM#ZQ9`J?U)Tro-WrHSo<{AD(7gbn5ia+Z>`1BZzG>DnLi ze`)sS2nL>(^|X*CJLG@a`5nykissxOCt8HTIwx?v5@$xGr~fkg)&|fL%0vcp0q0*O zheX)1DLKKxS*_2A|7(*r+Dgx;fxG+4GtSc3;(S*XEx;`vuq1&iAuKF>?+yGI1Hsqf z894s$VSm5hg{s~3B_4{~{o8xzAONYgKfCsMtA1BN|MjJx*^5ShPlopIR156?Q}62k_yvL<*?WuGhxRM*(q%J z>%siT%?bZ83B9m8R!3-MiZf`3XzFUR2#nV)ZiWc<$^{CP%E%XCzJ_;-1wmawuN-%T zr1b1HfVzlFzNCbNPhy`+Y(xhDfk z5|$!~8+`20QuDmrHLkVd!+!+N|Jp*qPK3XCajrpZPA97$9;uD7qGImf!Xe03q}_CW zt_B6Rs=3P{A)Sci2kZtU$Pu})cbmWD%4V|lQ#d93+de^jDi0&6V`fMxN=|q$cKei! z>z*4ucL|CsRuf98lItPj^^K>9^}NViWO4pw#@al#GF?0VhlzfGeKM~M9Y$J;m)|;^_Q6HjCZOc|X9eMr{jm7O9k0vqjYU@t@THiCuKq{}d)`Ge*Hb z7s#aTa&>6<_Zj+nbu1N~`9o6M>a|Aq!=7LM{SqaGur%yd`agsxZ&zr_f%+@n{Gej% zR+_|d9YEf#xm4yfV3XqKEa6r zt`;2s10M|2m{A~mAKK%U z_+2DKL_}}80Q8z#s?~qgj|^`rI8Wd~{951Be>~O(K`(IAWTsDSug7ojpk(Z1VX$v3 zpx{)YqSL70f8)%ACDdf*eIQ8}t6vLbF8b?tT5;&xZ9G}1OvpEq*9diL<{#tppRJHYyxbeyN76w-jprfEc4mL>-$U>Hx9$_d zM%`g_Qi=IbBVZv!bqOA4mV=u_Ua(LL6%HId5$!l|ume4^`<3-@VQMF&|14i0Jl~5l z%CGSd*s^Fg$g6|@nFW7#`%Vf7#;AUzl|6V7)9&4p0};}u4JQ;e+p*uwF3L*w(~8w- zA-8KC2Bf09nCkaGSVZ2;#z8@fXY@|{e|01<8DD%nGck{4bCfl6#X<|Iq>mQfXP|1( zC^5>ID-u$3RJFGYz>(`kfWC(cuocWv^47tmu|y1(-mR%%OA@#wDMkzz-(wOoN5FAU z3(A#y$iP14yPo~iJ>k>4NAn)Qs6x8qpo!kO>g-|cW=b~SR$opR>sb;WS{ZI2t=_q1 zd~pcN7*zF0qsAtAao}MPkjNF!WS-E>mZv~pU+!fZTt=dMgHZd^)=E@7PkVLU)*7w* zEyJM?x7ZyozeGE#e9%>ghHood_x&A*0I`98bLCo&2BVZ9ef{5jW9;#zMF`W#>|{{F z#-+cS@B8v|7eCDD;y|_>+q+D@t&mB+o+#Dm%vw?>RB9eF*B$`mh!ISfB(<0yMk??k zL6iR(N5AyDX{GtSGxb*+LF-QF$Y6pMjZrs;Y_3kf-Vi)=G4k!)O0nI zv4f-T@pzA&5b7W32zyy%2rhCNE*$D!_Zy$rNbNmvx`fn2Al+Kv#%HWMH7QWB93~@U z1~|}FiIt+b*h8gE0s^gC!DFb@`Pl$$F>OyM9E;D9Q5&k^)l!)X;Ww4YUKlv!K&rY1 zsd?+Q4G8DFfd}QC^73_z^56fw;5Xk6iRUk0C&;q0MxT91%^pt`=#(Ndsp+G7HJhdi zIp3LZ6dRmVWlNRSWC@Z|?}!P_O=D%;>L<#!j4&e?U~ljAmxHimxa$8fjF>BcQK^?UJ5Ks7&?&06Nv~1zD zP#!oznGQGQMkal+=iM|9V81OFd0!463_f#pK%aBD=9bnR0lW|eh?du zTCr%o>x+gJ&`d<*-qQMilM%qR_b-&UKajqAqX$8@pr4Ky0VGS2s1PF{Q1k}{L!CYg zDwN8RXcY6^3DIlZ1&b(A30YN{^W8(HAeCd*RGM{)!0xD2BH+tYeyvuH=wBPhT^Y2} z44GL2WH(EKPK2q4`ih-IDHlF5yZ`58##*KE13V%_gl*c8eO*>In~<8gRq;TS4AWND zGQMM^Nrd|f*x(CD5Kw61x+-}+S=*hnF+tQ!p7gFf{};IscgQ?{Fb#;Tn59&q&;6w^ zS3^tDB#9eI6Wf{5PA|T3Z!v)Wp=-sbPcZ47Ol4R9y_MJKfqJUDKv}H|20i;k{?FAp z3o*us6@|pRfM3_f9r^0s??an{PMe+oux4HOBSZ;7v%LioK#dc?C-AbzB6IbFw)KkK z--`TaHGbybM=09=i`w}AZ(RLfyjmod9RH_bxmd!Ve?eO*n(#j#T#POxg%1Vwn=a^o z%)J)y9iBGy|LcqeZ=j_oLWr6EKi_=Uj*A}szx)3=zyx0U@F|o3>x&1d0`mKlfs}!V zs#KwB&hr~u<&&OWxBTH#&VqV=$5j1{cL$W5!7neNX8!H_M={lu>?rku*B_4fuV;h$uI*Xz zMAfujsbWwPRMukCc|x=&^_N(h+=Vz`an1FQd>`NI=Gaj^^+EKqxhkI4?R>eM_Z;g_ z>-+IqS?}rYcsXCHv`*8rmg}Aqe;-BF%b7LWR?a!`P8hOzvYi!pNSo_gbY|(K>&}1p zWE;jPTfC@)KJ=2eIB`X|cP-EgaTop^ym!g)muLMjT6 zkxDxk{>dB&jm6%gocHWW3<4bBdc%1RP2yy zA0eQBgyAiFe&d~IOZdTo=&Agn;r%xFu0EUtdrX6@;iFlx+#ZH28lB=ScAbPF*y6m` z8V;#3n`C!yo`d)%)2ShnzYR_$T@uyheBjiSY=eRD;3ivxU+Xkq$rWjgxuyt${&IOR zdO(tRzFu`Q_+Wlp0(MxT6aDM|D|VP;m&GObCXk@6OX_hk7I=L7`i9xCnf{Riv9sPV zzR{F>MqkAE;nBk;=cKkC*HP%(kfqIlTt08I_)NIDj`JPj74rI<$%Z~}#`ug^3%Z7Y z^3v7u#6fY^l1OS43pmzc+4XwrqkUPaw{MZ(`^vNyHp~tW|bnJj{C-48etcz#!x@q1I9 z>E6l$C2#5VbA__|bUG7>&2s^cU_t&p!i(MZQm(#>@lLKx;Y$|Q)2(9%?m&avOgcY_ z&2&AEC7U0dA$Qhr{=vIvm9wvn_VM|5EFB%KObjST9u`!Le0qPK%Pb3XD|`Keju*S7 zrRC|N#5yRH!rB)PLK5+eY#zJsbbBiyhdH}!MvKE%w9%Cv?cLw)I>v-bzJp| zjS{lw{q2l}vYAz1krVZYlP4#n8clS!KC&z8frh^S!3+7d^GDwbR`m{7O-JRZpF|$|&ICfU{3d_;P z?mMIeJM8}Ar|;&L+|tmKJrGjf%h`OMxCikmKoY8%E*=L=mV3j$wQDgb89#YIUiHLY z3+M`VvoC5-#f1;;&1ACpo!?_bn1~6tSjm
UQ^l^bTsAC5OORrJ?X=koH=x(sfA zu<`8T?koqMIgUmuCG|ovu)IWg7qGn3>-aD_7`gwN=<&Y`gx#!Oy-l+mS5KqOM(2K5 z)XrH7hu*Qt<>#|`%8kGcd2sa6L3KA9iJ7hQq`^1a*TVMxnmC|M;QLh(vF*K^!v2J@ zC-K0RzqI&R9Cp)Bk9mMQLnvXJ>M8yX6lyBB<8TvRelKM#H-zotxl)e7v!r>UL9-7 zWO=!#>5QJ)sWvPYe;>J-W95}1A?exT>hsqCrfbK$cJXrtBf(04p|u|{&pGVrPHSHO zd!jY9mBw$C9#z3XZrDKWtmUUS)L){dvxL8GWT0jJck6)TB5|~9Km}@t8?{2PS_#%_ z)5L}{NPiiPMcun!w`tTq0O>s*L($luO_z}QJ&+^;lZ3}7Z0B-0GQ9Ftj@T(U&s~+h zGU~Xz&gFK#Jj-}JLnHX(Wvns+;1TP_VjEimI@5l9v{};p22zOzvFArzu@a+3sql2l zBviNLwz4#G`P+EpB{jN4#eFfhn@({ zo+7FnDv}F)If39V7ZLoNZ#^Af=sr6v7JR1CZ znTT9b2gBnSY6>a|676i}9Gu(TfAshsr3aG`PX`VSmEDHfEqAuWfOPTaIj7AZ0Z2tK zaV>e?X!4Is!IVD*MeD1FFL-FBAsTSlY;3!$;O>^!hQ{g6)?XdcM||N3mD(;1j;Ft` z*8J)4B|>^V91eyDvkbhwUaX{qai6zL9vkl?`|2)0+kNeTcc3eeDHt#He6#vBhpzXC z%tld|XrGF$X9by%h}-98tWH5?oY&U;oXC)Z3>EF(eVrIDw~XRPI-5rgH71bcvKV1$ zV4yJHAqMpru+iDAeNLEGn5rz2vXTrg~ovooRPc z+Uz}! z93SA^TQHTtz|eHR)PH~>M{8re3NP?>g{4-_QH;!U&%NQ^5nMhEZ-?bZl=iD18D9RH z@2zUNn#7uC#uYDja-cIuE1Xn1LeTMY4&_9i7HZDA9xqv{&ha2N@g@Q} zifCw(gbt6R*^Cm+O9CdM^z-btg9b2u+!SnxxD99Y%7*U(5#R}u`1U6{0_UW8;+gt$ zxx4bjEM!_rUj74E4Ihl_@lv+ih3NBnu#XBapw>9}HJaguZ`=;wq%1lhxDZfHBrWD* zKV-y~H5w)bBkEWE6xp4i6Pe$(r;t#6xpsKq$c~S0gbjlA#1hHv&2U7tzvjJ3npRN+ zh2X|-&ANdcgf6k!ERXoEJtxrUD-4I=yHeCd+`r9-g z1vHWryQLZ*pExC-F?y;bVmsGD*<3VCi!NoNoVE)?qG+L^#sQrvOD=Gw3tsz-B9-b8M}Rf4lKSma2CAZ|CVI(sd-P;> zegj!iaM=#ExGHi*Ue zA+}d#WQ9w72>x|J12|1q7XTpn)TggXP>};>-zac+lv&M@T1ARYv|zsZz#JChOCT)8 zfSQ!1P}75T@y&FCp^!9N`)tvZEI25lgqj--dVa*f4dp)K6)45gTr_? zCRLs-^kZXkdv)y?*bR@-Zxt#m`>`Li8Sa*x(?Q^OBX)5ogm{QD&vrcjl;vKy(Fy~` zQ+Wd)b&gZtrqzmC;H;tG=%*%#V*t57mSTkpF|3*x7{W?+59ILdN~dlv>;?x*&=o~L zRszv5@|2Wua#^ve0>Cc2q2sS#p+wCH9SZ@i2#(Dl z%p0CWE$ul%i>+r*G_z2awxklEA3{LvnczQ3KQlNm4TrZI|8d?*@S1Pj$+r;xOz!3f z0=(2Bz7-f_lYnEbhir@-H3TTEU`7qXcCYHSJMbfhNcMhEY3D;g{p<_%eW_lrLLbB7 z^5AB5)ogWGSRAIigD}FZd)&=AbT*cg*Z&f;?H43DVcl8dF8GL|=pg(>{TnnhApTdq zkbH9f{&xdCWCuQ;arMIwB&NcCJR@NCsd}{9{923G#-Wy8_H5T3Y}2m2aC@^8;hewu zJpRS`se3EtaIN|S4u{3U$gTIxjTz)ti8Rwkzx&!y`d6grfCaCRoEBR3av z;P#Z!=yBDtNW%40NgmJD$Fkw2ddvCa<-*n;jD*mzszGklQ=Px-Mx?jrTbSBpALDfY z>2Q2+=rHk0z+X+YXdda8J$MUzi(+~BLeory>P((aEdcbLjsSR{Tqb(1gG4^>K+}D% zJ|p|`@)V?yoYdRpBf;%d%lE~OwdfcH?rnNdo#MKS+d?q!TgVQx z!kaf>uYDy@SO?}IywgqGx_gcT|1ikyL%ol2)qS_`Oz46ho?z2oVUn9sFHfOZE*viW zh9cXN*>TT<0=1p|r7!!Qh?+4mK-xy%-;oeRPy2IBge zOT67l(1`mS)TTt=xBy-RQ9@+SLTE~7Gt@{=1iESl2(OV){`(806x{c>i@)c6zGB z@fZP~9&5HXtrJ|N2>3YA^Q_%axO@MPSjT0$=f$yPKgAu!lmsH@^_m&kZD4u{7}Qki4n?}K#1MeQ1=`}%Hw zHQbq~A0R)h94hAs+gs${`;cw-)oT0RNqnIn)c4duvwS+oP5)oLbK9e;Cx{O4Uj?7n zLflCOQX1sypxsF@p~PL8iiEK`DtbgAr#Umz-24UgdDg!2+AS&|ezbyTFZ}pk(>s$l zskL<7Iu<@g423*Idk0)3n7T>LeKOrdam@CyhuS7*Q& zMSKI9+JPcoEr^eqP4#c(FZ#Sf7MvDRsoDw~6L2rbkNP`LM#jDLy63kK_d~kNc`ucB z-nEKU&^rRTtZgd4Qo7>IuKZTv7LUe#aUkMt@D466#->?N$AvPiQ1_jX__L|YE2@wq zW4vgy^vVo31;DSi)b;4lN6@Q{cjcnnC*k~$I3%dL`B=D+sI8XiX5R|H&)a*zdR>8a{b1=)DZ&h5;Xx)Z=?uQaKX zpPFrA!pAlN;Y#=_{1*v+DeFyNakH`|7zXV*Kf9gt&bY|t z)re?mE7ZSmrTiMhu3Z`;2Mx}Y-)OQws;X;-8)=s0I_w7|^Tg?Pl%AY?mHnt2d={DA zB76*F0IC9N%*ToR3Yb!gC4)3E?<4sV01Y8jjHdlj(24VXf(XSSR3WC+agjhjhLn@P zD-{&~R@o@D>&z$!rsqU$Ht86!;-vFnKitItn+zaF*hg)wV{6v`Vq*c(C8}bks8lH_ zPy&~OH(R&RG8vFct{w&Lec`llRO`?X0q&I;fv1OXktC|3tN;Kl<46@~bFJ^`3%V>Ks@WQeEcd1_R5<>b1Wg{;k(Z zO41E44P&jnh2+9y$^+ZgCX6A=wR#t|jU>c~0P;ty@WJ{9G zt0WZFQpT}H-f7DLu*O)(p;cp(e^V+}pY712n5lL&yiu9~(asGaR&lW@xiY_5mW|7Y z$Os=GY!JcAX{+}$F?YoZseex)8zuBaR|aat{CZ`J0aZ~`iOa}xAW~7KNVQ&3-*1Tg)pjAjQ}o zm=vU1fd$RzQ}!p5i76Swh}eFksggNW1OlsjODCt4F#Do_ijw~!r1jeWZq*Nf;hk_-ilVM0OPzh@;+8Q;Po%kcgr%dAD*IcY5yocjpK{)sK z(Z=AF84lMb#(L9FMVI^!CKhI&)$e*#_JvVsSL4W?>(Yhy+Q&5ZD> zjZ|Kh8PGmj@2+3N{o-|z0724YOqKhF_lU9m$zhG*%X8ZN+xEmivrGS?jj6`ZVkk}d zxpyLm3IDq@q8!jmv^MJ9_AKyzHf1chb^*UNQns941lPvbD-s^c;hMXH;i!VL@&39F zwKJH=$1x8$n@0<0jK#)1XYYzxR>i*qMahdsCZ6RhYwfq6^>9NfgC1}k4&1ys zPudFt7f=3mQo;rg{A-yR{)W%K7Vf6j}(vvdB@FcDVx`WFK^YU~|yQ@i@o$4_(d z&W#-luf6NyM3}-^BgB@wzL(oQMmFEOK+&t2Mzk|}q=bm;x4(39)?6IMkwkN&o*yCG z&SWLB^fhl}E~nvNgt~ht1osfoaC*#@wdv*Qx$XmBpCErZ4vZbWg^w(+$0*7m6UC2n z?@rE6PME(qRlTVYLW$FL@ovmSYLEGrU(bo{Z*;-5*Crwg?^CI8n>l!NyWF7Bi?c$ulNAY`}|&-t>tpL+GSnCHp?l~V8Tm1kyW3$pun1Gc9oi!=M&Kt zjn}%O%J!nl#vIq(X4=ooh5?>#o17fpO<0337Ul?%A_a^5ehk^_vK5nAb||o|OdKPV z3zI8@O~Y@zPuPU>!x-_>I5#=9EAgjW*K-fBY_YFrDFE;wT#c34 zxxrkh_|6BmtR7k`lZ%dLH+puER{Dpy-7TuABJMif+C5+1oH9SHcMO!UmL(4N=O&E4 ztO%&oa0(ZfCWi*6mW!@uey|dF3vMCDpLE}(IErn*hBWs08{UHoH}Iy-Kt><1?3z;m z)uzFCau5DAdR@v-21gzPEp<#5=B2Uql}fGj3yJ;2n#(4>WEbP)%-p|US<4kGhuaaG zOan%5yKkE2IGRsleN;TlXqq3yeAIm2tMR6E(&OUXN@ID%QiP7?K7z4<^Fp-+U(#N= zgTQILyf@n0u=~AmwpDNv#InMhdD02-m1m3w#0-D{_%)~SS)5*NtDRu-Uq0>bbIcbV z;kPNVf{=7YiM_I5fN-jnp!4=lZp}VDktiVsoy4}{#Ke-^hM_J?rv^-eYe!MQwxPY$L5!>Qk{L8!{9V--U^Y*gK3=u3&t+*ctUGF z(0F`lfog+0aN>F`x>~(Y*_5BI__U0o%J3p6-siq>><0{g#2>#qK;c91|HIfj2WRp{ z|DUll$;7s8J2Mm86WhiU+qP|cV%xUuV=l9*Mtwq)De_hqpx9{zHy8FJ*J?C}I zn(%c|qz*e)kmt-UKoL-X*qY%ua3!qd%rB1}_`1|l+!qrbJi_(cJQ+H7hBHdsU+uJD z^hX<}Hd>n2U>dKqGFt}|^kEW~(+n;*yR{W-KDqtGN}e68*c}2`>>*Hp3h0>5^=jC* z;?^ReR7e+D1NWG3q3ooQ^lhX5)YW@bzjlzqK37L3eO5Q*Ggmt0c771sp>g%Lf4Ivt z)itD-Y$1CM8WLZ<*YGA&rXmh@$ z{pbQ`xJ;uI+@VkqnF}XDqs=*+*U1>nFZjqT)=k{ZG2HM$y;?>yju6ybGKhlhdG8Y0zG<#adBGSI;-79gkSj2t z*L=J{v69~WuB5Svd9rTC)>?lsC-!Rgw@~F6Q4u^aoNRDLr0vz_SwciweFf3&qc!$e zm(`rFy$JXtfd8+E@mtF*;OHJ$Z1>o&>zXak#>-imxs!mSEjilqC!p^9SQ5hOTI%)4 z|2D(bxZc=po1IXdeOs)Kc&ga=o2v&5GL*}r+pu=afPP>(QxKC}duq~NW!_;b+%+(& zH?|i!U#7Gensej59&WzFMITTtE9vbMq)V9(Mmsm(_{8O$k+ZG5gC_WQ!w4*!N^e?x zzi#<=>b-Gpnr)y9c}pOD@=!oe5e5Mej$0Zc3KDHGG#K#*zQ$v$OGR#(wI`WLA4G2qv~mhj(d*VLdDUNK zhw;Q~qpNnqt@`PR@ zOTynB#9b*jENATul#yL*jZAZ&(u9M`E-(Gx%rJ%R&bKAJXzS7ZSB6agKw_`1yiK=& z-ld+Et0(I;z*>hTaY8gNHla5DH?^dlZ}042=fue8 z4m@B|UKm}4=EWycs-KDJ`5%Ke{|phs)d!D-nux`GyUa_%h+J?Y$$pf>duegtdbKk? zyk}YoClZNnrd43c0oUV#W~dDF6_bBLN*Wy9%g3>MRT|=$Ft`l~esFdcs*Lt(Tq^to zGgAQj?C>7&>B#}|_pH^HC`56sW{kC(%S^leNk3jXeV4l|J6xKgN>I&Vg{P}7liMPe zwb{PgQF^M@{v}0XfHGpmmB5Th^jOLr)D6JxrbbqQ8MmyJHECZ3S z@2tJJjbC~mUtNzE;KaIb2raYqf6Gq(>w|K7YJGxHm(JJ5v_6t?kZkjAUp`P-Be#X< z74?5W*i&Jlk^XpQ{)o|CRI9ke;k5eISZHCeyfM! zyRqUS!$bc>v=-sL|M+mP{EVQZbGRz+sHv&8Jc~|FBX1QdX}#`DG)uwe0`&(y$zkTB z-wQ&$_wI<5fl-hJ`iV(;%LZr1$iVVYuwpJ2G+dM{p2j#Q9I2Q&x8?lsqls-f`qWJ} zYjbB8-fo<#RxU+g-~v$2AEU;*r!Yx(GPo|KPXe*T8YX8Aga0s@;f{6x_}_SG?;2 zT*<52#Pkx!oU1ka!B26-SB?F8BP8*DBJ%zMMc>uOBUmd>#8TOeJ{>Mhy4g1#$LYM0 zTs&{qSuT!d&QUtEN)XYcz&L5HBgTzxTJ$=2sxSi}5bIl#7^kFcZ$QTsk0+9~h3^yV zN-EbKmP^e;+ z=~)rG$sWrTsQkTix0hxH&EgjHuf!51ek{m;sW5M$#G>+!#jbYqg^^6x~7VAG)7`QAyxb2mbf(Mqp|x0kyErVPTu4;CX9 zkCTf?I|v_z6x-v+zQZ1AB2s+x7UI;23*#6vTN>SBwsw{kh?UG5Ba(00p?Gu%T8}_m ztVdIZtQRBkgEXlYbh3hNE@s+RyU?HW<*3T#N2uAJKdPbt^R+hT$s^jU{q9^k}Q|;0;gOpOaB}X>J!vh15E8j1c^9>`5kzuHUDdF?zV;4~k zg-B*}NWszVBV+-q@c91hid)c0A`FivdadE!9u^Xy5eXpS#_2 z)*sm9plqn(i;7LuenWFDsQbsGBWP@OU=(fonK_*KyZ4oNbN0BfbKIC>v~{b_9Xf7} z%O*(XMs}4)FJE*mOuP(pVPH*|SP8&sD8!)I4kUp0Ju!I18xqxN()8VR8$% zJ2!X3r9iviNg{}a#g6yZIBveKV#NqB&{b&uk@T0Wx2XT5o``8$MHqrQN?yBi&|HWK zf)1utk-E9CowMn$D%Vdhb}* z=j2}}KD#3a(mR42`o!oz_f@!!rn9%Iev@D(go}{Lf-v{CI6H#(uL#5#-va&E=n5e(`ntXmVh2-$IvBY83(sp(>Im@$t z`QdJBXCH4qP%*nGcX_)vAN2~$v@uS}>!)A5?R!8&LPOlIhsO-?XKq=JJ|OU^BHCP~ zqM)IjY#Un?x=4#A)SIj&Takz^!V~}iHmGNoBU)ZhNKTV!rxbO0dcK&2pYXGi~&>J)%o}Y9*Brq$WQaI)A zZI`Sj+5+T|=(u0ATe|C)6TrZQCHpb2%8B+srl#?mfN76^^lcxd*S}OXQ5}*WU}0da zn2i_FJ>|ueT0EWf?s9XB4VP0anP%IiNO>V4p&$bBmw()N<A=ZX0?P+!< z-(4(&x#jBUF@KS=<9ZrWh0AgH^_^%+aymEjqu1~Avtjyts7MKDqXqc=)(HaAMp|es z6#JFiDW@8BRm<80*Dtv=d2+T~IoxYlVmc{^SRPMeBDVr+y(z!3*>y9<`!m>RBBP}O zf>s@$Cs(YQ;c~6XhG2!oinIm)&=4%+SErzvLj%)6)W$sS+k=PdvJFNFGqnQdz$2INoZ7XmMCR-j9DifGyBYJDz%+Er({GrcpZDpJqJgCJ;EcS|txZ#xdR#8Kpy~e5u)n9y!t@OS zG-dr5e(|cnsG0^;Kjw%0)d#_AUMlMn&t6G(MhE%Ar#Atjxn#9GN z4upuxXmiS9P=_y1R#lO(d@S;YNaOq=n~CRsbCk7z*B+E<>9X5>g5P6z)3*AR;|?v9 zxJNUpCO9K}3zYBbY-v2S>W%mc+6v=%!0Y^6SjBAyM%NsVoY)t-oNej~;|o|(p(|Nd z@y&1_!`??pmv_TF%gj8`@o#u`RQec?`&#Ulhx%k`suEiXI9wh)=1iaD+Er!p@poqV zT)tF79>c8-&LhE>aza)sD-v+UWGzO8kFW zJPhxv@gci8aqmzwG26IgWs`a%n2cYs?|$#2@hL72k=nrTNd0X;C&WDhx4VKIUC*eN zh;h}b)moRybXKHo@6YPR965!JB>D^vo0VFd$#g@)Yb3%?i;?!T**`jE%umS&atA(? zZZVH?n>f+k<1fob^r!69n#Z5K`Ad)M>W)*7x;;l{*r%rgGSAKO_lVM5l`(`VUm7Dz zkJq{{y_L}!3GLJm_YZg6+nW~=DNfjFpX+PHjIwkq4~nNphsIQG%WDPGK2z*3!(=&l zIPN8{Q6D}C9`gyu5$PExo<8F@Gv3YDhpgh>g5Eu-njnfOj;BiziT7}R#Q#e1*ys9} z(Ih*4SV^v|Eg-iyRpsLDZ2He$V&GdilKG$rDjV&h97Je5oM(5ZU5udnY*(t%h)DVrg}^&ym|#HD{LF zrj)?jsA^28BwLMJChU-wWIR~sI`i@j#CE=UA4ejDqdAFgS}U?itRWN(jr4xY3qR72 z3Mmxq!2hIRX#Ms-Jgt&mC@E?3KdpM3xP-Qcgm`#;eO_vwvCiBlDobYr$oD$^k~)21 zyL}u!?Ug0bE%Xe-Y5&pD9+^BxJW0GjP04zO^9fvS+|FF48uClwnv!xTzcB0#HKY!Z zx#3SUrl^QGI6p27GyX|SPo!cT^}MH8T$u9vFfT?%c{_L+|BaJ4ID5d^cSZ=oYWt^D7vt~~f+rh>D8!Snn{Z_~30Axxl&hzeS z|M^J*#}L5EklomrpJ-?@2pJaYNVw67dDrD@d6_HciH+eO_{69c^LCvlnHMsezdW6t zGv)G4R;lH9Cgk%Ye+lt?2)m4_y$zIW|Cf%Dosf|2*%?uG7rEa8n(R*FH2S$5G&q=& z?5uHHD^5N|i&j1mWG<0roHKzYp&XN4kq>uQU}McqppcrA#26A68OV7EL+0jmsA#0D zqkr3LkDu~;zd>3~#$v(YeXV&ETSJ5UH;QnsVl=nWXre+52Tr zxErzc4}mF}u$ZkjW8>nz^O{zCoF&htPY-ND5&$80He)bE&?v17zU;IlH){i+Tj_?# zpXWxX!bU$v@L)htV7cV5_7~rLegFKrv>;wmLV}mQd5&;^m`w$R;~(zZJ-EsM5dHcNnY*5`FgGmV?tR1E>Q zjRr4Jc`M`ea>;)9;iTg!X87p`4_*k8eK9^h|J!}WUVgr4UceGRjlbSthphA8NkJX; zRCg!Ol3jp+EE>7EyZx)hb9-On$ZCH`*30$a1W9Ty$&pkso=#XApwH(ymK3}_%UvNc zm6&jHiM6+%~Y*U zy>Vloj*2DQxaum>DGHOH0_UX!WvVD&te=-rrA~6hC23IGCvR` z&-gp*a{;S9w&5<*S-lvf{q|xK7uhzG#RG@QiHY#jNQT_Dj7gbi7s&2ep+QACc$%hM zbp*4RWL1Z4^uwl&UPkJukM%GHZOXIEUJclA(*I_*jE09-c}rehWjn}}1+~rQ9P1cL ziSlLNri>*Y+H5X|2tK(q#S>@R#NI69uy@MuNHEsYkt(|W7T&I=PG!xPQ|_F`%2^-b zxKknl$_d!n&+c+t8XF6rAH$K)LEEg357AW%wav#Y-_dgPljpOJg*UQq%e>kd+A)+A z)fE-I%LI%*ezjYn|KMql0nS0Ut?~jepaFl;;p^9jMqi!EIW9=C#m?Je7B@NWouwLj zsO+{J`DM~=mKj)-U5mSCS6H!b=ZbW?F@uT*2M=Sup@KMUnqg%goNQY^MWuJgR(t=Y z)o3%9;usr4wp?nqwIXibt)`0sFkMBRlsqhzYIe*=2M%}#_tXA#F7IM$$2Syf?hEto zp(4qi@LiGp#23SBoo{{%&CH+6ufMg-tLg~Z?5PzOOipouEzLL7o-Eb^i7q{q?F|XP z$(1X7WHYo~Rw?%Pc3#V75Qd+Y*88WEi^#*#`RU8Q)+(<)nzr>AU;{c_SzHXw!gM-$ zY6I?K`aO9n6w-jgNuQu1tIMBkU-cX;f21EYajfdP-5oGTYsSBzUVRAxWg=CIo*bUPt?Q433Z6Fo|H@>y6C*WK z8d*gB2^Rb+;db6g~5*TqjyvmxtUOs?gIRglVFDJRFt{)i@6|pYfV_@jwfp8z*9vd&p*pU zfAoE|K{Q4n?=lKO*RVQ-FH!Y`gmM#Dx z_`)Y6O>-m4!Esq*Bb`QC4kfWmi^FHCQX@h!D&X~>{U`%EZzIy&5OgBik;C1*8XXup z&whOERVJvjAH9i%!R?LCtiFK^c93F$f@d9DGE~5Kh=KVgR1}@c>T|rUI6on#wY=MJ zlQ)iMWj9}m<6YUB8)F$^q-4pUdWWrK6T#I+J)4zC8I>wAr`y1-&fQ1r7iKkAPPHOs zQe6u1TTAfQCb%HQD%CHKQN#MvWt(3oS3cgVf3f8e7}SQ~w4BVIdPPHG@U}2H^4Uu% zaUgo#_jFZJ{>;5N5i|du)~3PA*x`a zwxJ*r3pi9l=sk7pmKJE>b}MjZR}>oQ0_UL5kLtP?H>PoR%%S1;;Xn`ipGvpKpMD{> zy`Qvezsa0(VMYk9dW4kG{H)HHiT+FwiFStF5>RktxHN z_t77o+fMJRui9A$sO=_#_kMrUdkNjl&b(K8qyEgx`RqKe?oZQvb&iC`<$7{58$eqe z^Y8WkBnWC;Jto0PYNE@{J#TIv8;y#pjd8ob&i;^}>&bpX@JghxA_6-wzxHpLhr`F` zC;0KsD+0JEUBB^Qc4r6@p@5UwS0sTqatp{m( z{g8ns2trcWH9KE2P}@nLtgEmgD~sP?(`R@KeCGiAu?BcBw#Qo98k65R3tBu>OzraN z@pQ$Da5n1~1-_;(8jI7N81p1qA(V?o45dS80pd_JryWiK^vhhFNhn#$#qsP!#q;u$ z8DQNsQ0?=eWX0LBgz&%fQ>^E3Y<|FMLOg)m2=Daxc#chKxSoqJvo->Q^Cx+ZUm@%M z*>XVbd+_l#j9KXml3=V2Rg6{3LXwlU=_%Yj*`ov6_4sn^F%`2z@^N^MJv=4buNQQPQ^*>(R7Ur=a>UN~uwsaK?#M*&o> z#G9;gHfA^ugtZ!P=@VbI*y~S4W4G@3Wkq;3_;LUrW45xX(26NC1w03GolA-@!GM!j zuFT`|iI4AnVGq;yy!2;=n2NT6m%djnl`*e2IAkq?22(`{Zr&4h>o+nuoLvr1VM^<1 z&XeY`Ozyp}_ptD70Q1SKc^B!QP%I96Mq%rZzqRi#GHw`UaqX)k86l{Wv3e_PLXKJ*XLyL8T=8uR;j zJqdcPjr_b-Ee6>|{QAlh8OAfEDtRFy<`IbX~; zJ}!0cNA2ttWIVEC@%6VJsR0nYP8lhtyJ9P8rn$Pj;rYCe586!Xky4JUTZ!_Ly zxYEBl!wzbqZ|;Y0f9X7_g;;Di+q5EEmhB4(SGubtj>{N=(MsP}H>!;F9oN0^n9+@f z2t3jQlZymaS}&=V3@p0;1h?@cqxl$Gl2zOh`M{5im=bxk56+d7M;w{hUUohdNvET_ zy)H>fwGSb#v$?Xh50^=nURIm^ zTFiS$bH;GGVcvmPlj9+=w?}ZP(vebfH6K5Uh#4~qzqrFSDdCOOnk~@TtxyuHucQE& zL%4XbJN;b;NGEH>y}qv9dP%g`R5#|A0SQ)0Fz&=XcV+08y}-kBOU#6d17wR0FPJ)<>f*iCf3$9%UtQK4 zPA+~_FB1>T77#z#PG%S3)k4N1)ztd-GwuoYCFDBYFWn#)^R$&Z?`bl6c>ZYIAfaJQ zZpt*uDH#KzGf}u-9uOyL0$oo0O482PKj0q!g~fz1*<0H51`r$f_8;f>Boh!h=)X_C*^V)1ORP`f z(>Xy$*b=m>{}3JGsN&%mKDH;HEoBNGcI^ z`xueG)_s@iZX$2yG&Z054`LlYhg&?g6;=RUJUL#!0j7U(fGR6?f_)+2U ze{;guPDRU8QE@qqidIjAn2G7PruS^Qm@+Hq9nh8mqJL%WaQsKFr^9xeir8 z8)UtB^Oa-s$D8*x0~;6B4t2Oubs!ZcveFxG0fW{KHzDxLq(zdAvg=)lRYEvPCDFQ& zs`#2U3NZ}MdZi>3B#TvUsCzn{ZVdHir=Sc9FSpO5029Qa#;WQz!dLYe?CS%F`}@4U zk!nM6socl8_b1!muakU!Wuc_wp{<{E!qN2^PUn|?F~WM|ni?K>qd;SDbIAmojWCqF zQs@4rsxxGyfkTbqY5qQ@g}libAzGThNnV$GUeUVE6!#NI7HDsgRm0sM@Ob(?^qkZQZ%Io;0_D-v|}Z?ha&Hb44{T9nQW99-pV# z^f}VfTbqi8;bPw$+@8V;r@euWZ_Vj51tw#H`_u59 zC{I&*_?&~MXO;*j>kFHU=Uct2dd?U`%311gZNs1;3}+JIfoj+UF+A{XcY^##|*RaTG4QmHf78&pqh?=N}*X zG16qfMW;;lUEDjqp!jW|1phhr@Y7c2H3h|^OrOwtJNC9F<3e2YhQMzgB-qiKK)U@c z+D;{fS!UZk-Vx45SpEX|FVI5g>yulZhTIRN^QD62 z*wgQDPoDe|OzDY4egYo5*EF>kJ==*iXYe)vklDkO+`Ka3y<0SoMT73Lq^4$s$yh2w-bX)Y&5^cZ1zG`Ib}ipbJ{gf^FR4(s--gx#Mha(qaF zi>51un$*u?kqp(?TMec_{k!HwWRD^VHBRkt^30j_2K~*pCp`3~oBfjGJU|GB^Z91G zS`N0{_HRaAH=4_%AwO2m4oqS7&xq9kkNXQ=1K^~Q_QG1ve&{tOl1+!JE2@|>wr%{B_My~b7@n=#Q? zVDp?{fl)U|UqY;k`|>I&S(06SZE-MQ=z< zt|C~lnrcNNqPsasBp8<+GaB0%PuLV`8e^v09Wbj=O)yY&)Y0K`zjC%w7s%$pNSIow4oV6|0*SPr*hHiW|yT;LfJGHFAxxVlAd#s(0jUz?aU zNMK4PhM%A|{C(1{8mi?TZ)?5(tNr&cUV~5XEZgtfIQ?jTwZarwW@(`nqt~VWJ^*EXkA~918l^qMKi98WXPDXkYIJwKM z2OcGLr$dYUt3WccFFAQ^@t5(J{Se4BxV?2<-OY7Gk%*?uXnlC4X4_3qfuQitl{cLN zfd*cK(bLPWDGnKrAE%ouuM@q_qXwg4UhOuNDw2ekJ`l3tc~!?i+kKO(MSE%OfO69` zxVFv)-$6jRp+1q`*&G=GhAfJBCOSgVYyt0-)haQnXhpuVTrs%)L)3^ z?{Wd-v$i|?!(v+3Lf@t+h)h0N`4MzyTJQ@vrpD<3)>c?5X=t%BGhO3ntIb*CB1X7v zAx;}VvT6BwJ1*}oFE3x} zP4?iv`M$R`{waOHlO}A8gY4hid@73QqYKQ+HFH|SYuPoG6WqY zNup*E89ftc@Vf7i+g-V9s)z&0W;;(b#APyS)xR9qGW;DtN4QB#)B~G@EXQN!^n--b zp})QYdKjjae%*h>8h@kGH%?CE_6t6oD(Jaer-Fh#jmHZ9SA%oPxTE}&s`WbHVr44` z(tFK%gMZ70=iV=r9^I12)G`Awn0aKq2Dq4+nqR^QMGFVzo*zR5eJ(1Q!E(SpyrcQi zvC5cZ*_}&ZZx*uPQOH~!Ky^~KEBwIwS62t{&v!-J(^NEFKNh_Zs$>WeYMi6mzNWlG zvl%$k<<;Kif|s0)sFK$D@k2o12legk0&>P^>{uiC0Sa^H)d=Ep(DCc0j*q+u#3Gb; z=z(zWeE%|=E9SxqXOCb{O`L7>Ci4!3B#qR70L?sWR2Tb;dUR(q{E|m+9|yvwSsIV3p~tcDuX8g$m?8=s4D8K{pvC+jD+C#m2;1|PaC?kV$f`R# ztl3=U;m})J4}w;c=h}W<6&Tou)_Jsyig4!6r;gl_`(s*`awf~hYKy*}&`ctwXi8)? zKjBRfp;+MjPi%ek0LA%KjrCU7rNyf^8)Wtw1{hIugd?>=v)i6>Yq4w z4d`zRlITIbAddo9sufI;aGnDM-(*S{2y%C3WdJhG05@y}9P3V4`<&+SJdplkn0UpJzWHgDVE&dFApcWwGu= zYmy{QXHFw)&hSAlAUWkr03bB`j-B8$X*`|%o32iZKymNi0&qApEPrG=!F??>s{kPR zIA1As*m@+&=lCG~$VGTQDPO=Jf#y3Me>=gox|2?=ZOiU_vzfC^{%wI?doGzt_efok zlPonQ&04M=#>c+j_OMZCexo7#-ZqEahfLGJIqvTkf@0t4|JU;9uPdUahy5l@)^Yb9 zdzZAb3*b03CdO6b6aK%`|Bsxh|0`T?PfU_PKofaTK5}E^k`}iVw~boqKSO*US;Z`- z-A+D|%w2o5ARXl-5fkxPvpq4Zy8G^sQ5VnK_m$bpOM!u4*xwXBU9oBn9E0}KqM&a! z;%&mq3+mMWA`V*rpJ2b+7$N2vg+b0hPZHr<-fvdl=u?1!6@{}lp#9(G#l-zd;aS}K zpYOHdEutQl&5}yDfxkW83=x8IO3)LiEB_d{AO&=*o82kdA>Q& z;UWg;%0)~6RxA>Koe_O)C-Ojz_Nr76{f+|SzF+ymtC8?`B5upv3~U=I7VvPtwQv<( z>1tgt*Km;=Kv@1?9v;e1lQ z3)nT-56H2sLMVQ*ErPob&-!!>BCYHA_-Y_7Dp|CEGPs@ZG9NMuE5l#%Zz&`E$=(M&Tx{v2RM+Rld0_c^cD-{()1Bi zUVy>cRS;AE1hZm5gdlDK3p?m(A+ln)R4|w<;edAWZSWh3k2!{jLOdbms=^8kU@hPw zm2Jl)gO~~flFR1L?aT(MB>X6H7L0eRi3ckyzYCT?g%fVl6ev{&wfytITtO7llRtZe zQCPvx%7u&0|HW5vT-K;k=fDSx{7fwsXb&N+U4+zXTU)0O z*V?=|QHMRTSrWGt-I+now9U_(SKrROOflMY6pxSSz!TwE{azPAt14X4C=M$l%I(>U zExnKzVUA(Zi4E*f!`KoI3ZCt{)|9Q;Pg%?J8{aK%_PU8p$-=IJUOfy16@_UAGykev zp7vT$f|fNzk(puw6Vq2-r{?07kQTp+cBUng=5v{f8e$ko_2nSq7P=> z0cX9rk!l;0NbO0`e9qFV_*xJD!hP;lMsJqMN%EJ0mfuS=YY-AGIh054EDhMkY&>#` z7xEWa^aNRn=&2}VQJ1Nu6`UOW%}KfiN%GICpWySW_yJ4Wr2tJ5)6z& zJF$AGrmS$;_;9?T3T-Sp2+SH8?W;4TElDN9$iY>s2{ss&`Smw3lC%$zico30N4OvX zX3B8C3=xaO)qW+bi8S(~;(Jn2Ne5X;r^cX2Ass3Fn5saf6RHuIX2roBm`l@rNl-+sW7petreMI4GSeWKMEN{s}LP2eEzvNpf_jF(jp7RblAJ zNCJS`5FrrZqt^{6PXs|y8&!Y7baFLEjO=mVv>0K8bbd@xJ@IU9jwAK42fn}1N>rrW zHS2W~pTpt83tf}0(4@b5W@*%sFZzQLRWx>L+$Uj93b>0#b`RJ|FH`1<*>Qu3akR z3v{~vu)(Z3b2;vpH3rQZz!*Sk-k!8XQ2@P29e1-7k!801YlthG&d@~}Hb-(?>EDRK z>e4oTYEhg#Xh)4B@@KK!^4DtXlZ@3Mwh-#g>mY=5T@%zkIQaFP9v}o-0?gTO%tHP5(>h3!$T0}FT*a3c zx9I)-qi&4(dpFEu&I^l}Vd%?rB=>q`qe3x1COD*Kb%ih}VPU0VdFp^ZVkkUnz2jqR zt>R)KC+TP*rX+*H7{KFCq7R&vakPVnloW8Zf>|mAo*>zNP7bD%#%2kR=AI(|4D}DA zWSC#dv3320R7Pgw~r!r-}dNDuRH;hS*`v zBs?4f#_WeOtG7eeH4MAYd<`YCigWg1l$b;hu{lzd43YZhAz(9yu>!NX z@XE$V^?_Bm&!KRNVCU7f(GZ>@F+mf9p#V%ORwe*jSyI7%v4~`3ZkEPecJn#UM99UY zv)sRMEYvEnPd`m*Ml{Z0Mu}A5E$l{XLT<{ga@y~P@xlNrjxrapVEXfS58Vat%)?kF zk0y>CQQf^kN9qqJWGH@(O(iKP^d;}8L|H%Tfn!&{Z+LhpY-4)3z*N~pNUlzmHUVQL z?>5@DROTDzpJ*+-6D-!={RdY-?V#MvJKHUck!+aFslJbMBCa=Pd6G_87tZldi2-Pz zoJf}dqk-X3X^l9WNIRFXKlEuo;C=gO%3M-|Kv zI&4aXZ&Hm2fr?ozKAAMhf=Q3cuh@kRpX1MLXiG-`ir!u$-%$3whnpn7 zXtGX{*_sAyAg&1)lZ|zm?2$Rbsk(@y-{!7jXn4nz5+A)HO)qxRZCnOQjPVFELxK(i zex0Drn+JNKLQVvAIJM$0a*V681rTs1YPnYmDOEp(N!Li8qlt33)f2BUwLN3t82T)U zvVzvdKT6ts5Xar#*49HP$8A$3Ds#8FMm%h$JtMfo3KnC})?!6EA6=61M1wI&H=7_j ziC{3+Ywcu`YN51ef$c|S9V0)*-wFf_5URv~-y?9{VQ?;bo>)wmn-6>^S3_SU)%c`_FxFzfaX5XW(3~EO(l@p`huG)dt#ofg6-xi+564=W~15v zjn!n}LLXs;lAw|*d7*RgEwPH;&Mx=$bsH+)i<0--k!TQN3B(3VguRdJ{V9!8_(50C zA=MKLUgpb1BoG`kfNHyr!i@b(7po9P5gO_&r7R%20!k2q%+D`E=08xw6dk|r4h85e@ zMi|yNVoomr7hCiC^qd6F8HrYixMGIC6Tin>{+%cvYLFsl8e*vFD)7MFjqFR)`;uHF ztZUAHCU|^OCF{7W{X1FXok{!;EbeLDcctT6Mq@xV+;XKZGNNQ1vnSs|9X7P6K9@jU z?MGaPBG1jnotg^Yd$gG~+g=Pqj`B*V6m1Gv)vz@WU-Tml$X`vQ_r)P--<|ZQxJ17A zFZ%9Bl)PMhCTiNHKYdF3T^c|TrU7A2JWu$Lp^r9q=v;-FjqskAn$mfl`I0URJEAAG zWnPdGf|j3p;6>&1>NK7mF`}#Q?g{VGH^h9%>Qw-kKhT2CJ+K{X&w6jsZ{i}if_o`( zd?027d^}{iKBl~&uVh%7NMpB?ymkqV>fm>TDND!5wR9f!c zAYXpHgd50UCBkCt%-CAfrD5z(TSiEr&yaJEZr|@N|Fp)I*M#FiSuv=E@*Rn#u?n&ppYuZz{;trh|(g41Lh@tWaKhoQOOF_hMm-Hvt z-c3-M!2TG~aW%p7`)Ux>vBGF>Z*-NWR6orCzXjTORcgcyvq z5y*Mu(DvqNe@Csl|0huhksq^s#dz1&yV@yjwyQjqxi0?@F!NtC5=ip=;w zjq6kZEORhqy5b^gL}k7^oC8Dc_7AJCi*?zQ0BE?qh`QXKRU>({F`_~}3VeutulsIU zllVSbq~rqpL&Mn?U1A|k0%6*$8yMSAqFS2io`xZyk-Evh?_ zJmqWnjf#xS2gB&2+6&ozSWofEx#9BH3IIBP41@pq{7FGv{F7*eMrWMpdsx^^3_qMM z4ua1&%f*5WtBq(!zt3Ah7alB9_->Uki-H>Z0NRoJx_Gg)IlgoRiivZk;}0~w%F_t5pfy%_uzTu^H{+rc~Q2{xp8%w z&y?FDJqd#fRYg=^*FYi1Fv@$nQ&4E%vPONel)rrr7L-PvHTW~s!v*6z+_U^Kg}Wab zw@nEPsv~W>yuM-NYx*!>pLEYs0y*SmRo|^!g0Pf$y+kkY#{d1#a>&U3{U4QX{(m?P z{&yn(z;qlRLcn)@j>=#%z4;y1%ugtU!GiA^48@;srQICQVCPhyYUd!O$l`v;Z(Z1) zD!gdA{Z~E^aVqzM@!)RAmR%@1Q7C?i1MJ@hsrn8v3Lb?KJi&J1Q)hTtwdRDV75qALad2Om43sD*7zGZ=#qvS0 zv$41@X7GBeRqk(?RTLC4Xu**!?-b+Jz6p`e5(Pe#1eY(wf(6|}GK|rLwBB?k4^4UJ z1rp83SH>!=j*G>6SJ{OIn+1*gw@ZX>mwm=n9y5sxiGlnRrW#UR^jkaA|0bfbeh?}t z#scfj3=qxoEdSp~`^M*9nrQ3Twsm4#C$?>#*mh2wU!0uSwr$(CZQFYD)UEpm+?&57Zcr6kZ`8SQbxi!AJ<@ z5AhNuD;<%XOH;2MXbnjt@{RP6GgohCP7Hq%`b~f#*lPl^9(KU7pkxL%sTQye!P&wV zSb=oGKYc!*P^~=r1oH*=iD={#tmd4Zy zde)z%81%(KgcCp3;#ijiCn~iuGr~;wvg>-#%1TJcA5P_Y$Mz8;;$Ca3+HXb026MW* z{GOMgDn%N;JBBeQ=Gn8R6{V1kEw_^MhJJMTQwP;_;=Iog_j9G(;XG0|yd4JShoK9s z`*4@Kx4pWS7qLswB9&prb0G4)lAu6@$iU5PQZV$OjDaq&zi%z@=3*29Zw+ahwqQ)C z3X`U}ve)!6O6vrLTU8vq*=s<^%y|CGIN*tADcH-^bjpf56qX;m&#I=`2?wL%j2Z5w z%wtl2T!;5CSBt{B{W+Vf-YVQx_AjYw2;9nI8I`;&yayq0*4 zo%N|J-+L7-o;p`cFgL3s%e{Y!ua2)>r|_hP>5&eJTsdOnlzj=SZrAlrF!*$Q$P)$u z?=MHAG62l5w`Ffd<1mUfmt^Jj9$NZDELw;b9$Ul2P%v;jkw(0g<5>8K$Fq05p{+W0 zz5hb?6b+Gg?F&>=`Tq3x+e$-C-fV=_86mwn+J$>wYi^O0R~uTo<}#4#Sa7u@A9RHx z+fubt=B4b(Aj(86HQQ#wY)jYTnSi&n3hz^)wKmY-jVb`7O2k0dgp2A$R$Sgxa_mUr z)e;oWH+lUh%h~A`#-r@d&Q=fIyqxy@OIk%^b@#QqWad!8kGe57X<=*3#)h6vQd0hG zaSjH?RlJ>?9{WTM$79KdA3ro7v0)769py29g8+HMVaO(0-ia!A;eYiclj;S38{JMB z1UNy4n!IcOaftK>z)$H zLR;gvEt1!n$?LZ)26t+e2K@~8POQcJ{v4tQca7)6>i14j@#ngg*~uTFL-W6g`FcjI zA_vpf^X>L{Yp%~t?VEXlLV=(lBa(t?JMt+R!wst;^ESpgLyt5I*kfb}0RHf<-i2M0 zoo~fpMG6(+4s7QH;$>8Q*7H?u(4m+a^^nN{pFGEEmd%w}X-JM3`NXC8UdFWA!-X{( zk~RO7N-Kw&$aBN0>ae{iquI_I*83vi(UnBEUMW@^|80Q=Xan9J&b6%{yDrY5OPxkv z(b+v%v1iJFH)XeeZ^vmlAC(crO5Fu6ZecMD>OjsBBRQNK_1_G0Y>dS(sl~irIUnZH zUJ=QBqW00NBwLi+^Nf=03uZGO4|Co6v?1) zV=k$YSu{0?gWc6MkW>g(&rsm`(i(zv5YkD7Xv-)y8!EqCB@Zoh5L)>de)Jk|RxI;t z0g?o27oS`l<~*wLf?|>&tLd(Cr%n->K;nd@@w8jYE-Z;(=0M~6{GiQZd1k`nnx=mD2!NP<4LuXqW!5>X7sWd7wgsg#F$Vul_P zv8^`AOVht42QSb#PlRhMXJ$cYwDRSSj6<3BA4cZCxaQm1-VBr_fBrVmD35Z^tIVgh>h2*;@R|^Kki7T9+Gf7-@wuS(@Ady# zH}F@BE^gOSPbh5R*0VCNc^#<`oQnUO-f}~!g0*Bc+p-hW7oH6FwW1bmlL=0*Lk$42QeeAw zn2qUz=V)j;IUaHmd7#>X2X@fp73bR_~UFbZxrIq?)-qdPanw&F*w zB$YL~vVWG^;Dio_HN)RAKIO>a%s|7L4vXtxZYuTKR6IuqyD{8Ub8^|ogG@n)QLsEG z$uN)wta;L$TaI8%LV^tyJk5@gU$Ty<1>!exDv-Gi2|?G zU$XSE-6Kh+W2~uUb(pVXO091mRjjoNUgVl;L9?uTWhU}t)B`8wJfrC_Q5scV2neM@ zHzC!uZS@4Qn)Iu;4W#V)j_m?QV}6O2q*UrKa+HOC27^>N=1rv7Gh)cw;>oA!le)(e zjwO%{3VFE2?+(08Dl$lD)VR5C?oeR&7i3@|-fm=POYy)6V*xoGN)8QZaY<579VKY@ zCE-6i5<~Z7a>QF^Lk9{~yAtP5D7BQTI0<#Lpf2Q6&tCTXj!{V2)24uU(h ztl=VHC<^BTFpRktP3@HrGwdk56P_;rye0lBxS zM?%htfCqvAIcx~PoQ6O~6)A6Rew$eIPhtP5`SuZke5IstvfM1mK#4&76=1bDC4u?k ze}Ub2(X%&Q*$O`&2wI&YZ`aB3V=LuqNqoDt|6ulyK@AHi2eP%1>!II}1|r!nMWp~! zDJ~hOj{GZ#m#6$W3rpgaC0_$80%2>TCJ4qI%N?rFDV+{jg1uA71UymN(-9#7c8UkZ zS)BhiN_vGuC*bg-BD}r?9QclZpWOyw%s`x=?bS2q+#;zGw%l%^nj_{cBA@PAN;I%; zl-sD(G%``FXzplGUHS0n59XdAfE9zJKMCx4Wy?YRn^Vjrxh1x&#Qj)g=RuN9k9pFF zsiMan*k*WA%WmaXNLD4m-&qm^GJ7E*M#AQ7FoQt2!Ndcf3d9UhOQ9@+xFDhs6c%AW z&@e@a4jwM$!wVU~x(OIr$=>Z9J7D$pLxT}Q)%V*wZbp*ts^&ajSuZbP)ifb zS93t+Wb+TeEu1~?ksZ*o3NKhKE6Y#9AQP>m{P=}SRHVe>tF?KUrSqRHtq<)_?H37- zd54tt@lWpnW4CKrYGledIFPSksB4BcFdVkwQbIz?2N($3fU!#rELd6Cs47w2g^?E- zGGPhO58IPNx;0hl!6|eRXRhL$mJE&G+$z8sS`Lm^k{JgcClI#Kn|gZ?+POBWO~khX zKDU?^FLckGN7Jw?@GL;kFyG_{1wseHRNe_SbX2e7F;EZX_jE>TNhMTiBs08Sv@~@) zrw7|26C)o35IUdPaq26ZhNy~=)NbW=HRu3CgbeXZIhdeBi6iX&Nr2Ir8zKTJ0&!W^ zW&`Ci*QQy#9X{QR=x!wQb5xZ}=Yw0L7mEcg*G{f%>o1TI8P1zw&nTvyVgCpvHJOU9 zp9{iNRAyg}wXtGS)Z>5Z?hEM#Oj02UUCu9gB;kWIA7^73$Ww{7H`U-9M7DZrbrK`k zO$MzDdE&me@T4i5g=5z1e0 z76*_d>XrJd?QTtdJ|nqo^{|fi46!?NzCtYImLOt6CpUNtx6-Mm=)j~T3JBQeC~O=) zDFQ34nY{9@9%@^jZRJ_$ixi2lz6P)ofRH#_+eFo)0fSv`ZO|f0A_XGe>Fs26Ro||8 zfvA|X&5bK_%dZA0(_t7z2D+K^7z@yirou9BL!&OJ$FCXZe#3LPHYmB3=j+~8S zq&Il7$>3ktp4)z`4!_`kJ`Svf{AFf+mGF)ylXsWrtSKs&H0)+wQxuK`D2~#DGytBl z0~93lo=myCcl6rO!yda9;qqP9#gdG;6LozcK4^;LlW7Ohukb7aUqjs$JCnP8L$4+7 ziGt@R1CAO->=P6At@PE#T!L&X{7rSF4l4Scq=z?JGtfxB+|oajM+J|!ju_dUJ|)sa zrwNPLXrTc@JWs8XRU`F?Q{{6iz+2BZEosw9Y&-v!eQu7u()E2ZRPP|~}PvgBH4$!%$qgt&^ zU08Y~D#iSlc7c9P4bydWwe`Q9q!z;crryIlcx}k7I6XV@xt&~hMQL|KhCm&PBh(AX&xC5_0&wy*3rzr5tvv&T7qhf zNyTuEp=9kKLxF@zs^hvgyol;?7#k1G{X1x7JGVWW<4S~3yp_UCyxRD|?>G?&O;u(w z6Gn?RKF*&tl>hK2`u=*Oj#RYR3Vx`AaUcG}(njDbZuEIPYLfUeu7gIY?%opWng?p; zlGj3_K35cPB8=&CY%1o0o=AgEtxRF04B1(91>#M80;UW`ySM565ygllRpB0OFMcAa zo=I(~xLov6iAI^}`+FP+(dV69Ojf0@6RnI1bsz*AF0G`&nQxLbx0{QP2_t95c=oaS z9rmQEXkYhanS=}kA!-_M8xMM-pcd==*r`*RKWJZ|v}3fkr2WTi1W0JqOi`0HWwhXI zmW?AqRhhf>{e%g^h2#B3%)JRMYkh2WFqDgR;H8&_OeWvaoG4%5E_X!3BEnP61|O@_ zQ|oVC?#Q>*HP22yrTCHn{PAMc%ZHuUpfGX{rxBH@Wlm-2?s~_UsE^JrWuyM&MV-f zYgR0VGJ{bhc^?n7!wL{181hU-k8t4w?Wx(Cr5KQX>(RJz&fn;!Q`M? zPyk;!HyO@+<6@PwrHRvgZ(m`Lu36tN1^%L3pR?ymiE7G<5yHFsZibo1m$xCYb}MgG zw{3fAUr^t73f05QtH1yspWxEMuFv6)rwiAEhTqN0VJpi0Y!80YD*CpY9u1vaetb0M zl@-n38$DC_rlX9v_57tJx#n6(O^IBB-X*TXd)byQrMaNS=U3d=(0$XQO9xxT^-9iM zzhU&p;^DQps{7Oss?dyOEUF06zXaN9yK0V_Y-IVDncU#vTUZ0ub@$DiTisMRb#a1S zxcPPUt)iM`rf)b@SSQ{q9pvSHCmW__T^(~OvAEeqlo;^ZJn_=;5CkhNcPt-p&}i54ODwJ8=q zHP&w_mv>a`EpTxK^TE*TLD8mUfk~h!KC|(Z)6^1~EP&;N(exia9=f-z{k$FR)f0f) zAo+N}c(;8Kr091(Ad*Ct zVU>FPgV}S>WX@9pUY6@>fBS1qPMW75I9z!O)-`tx31v~D5W%uhv#`m}60|W$_>3Z@ zhuEvjta9tebO3vI!V!WZLok1_4(hFdh@KncG?7sR1kP!BQu5atHHEj`WlJ=~8Zg96 zqp~iSM5vo)1=P%1^zv_k%povSPN%`ImjeYnC>jwVA(JQ!9Zz)xq|zg}y8`kHB_y4y zI7Ag_5>%!Zf9O02rvE>NI`e~n7?E6{4Lr`i{tJpJ|Pojzh!S@}m7EJuVFE!}Z_ zwvtRC;`-BZQ>IyZt9JPl3F;f#V-s@;{iN2gqL-ad7ym9kI~pfO;4b z4?y=nQrw1#Ju5@~bUfU%a^f;^&IqD7@fXw)X4mtbdZ* zQ!t_F{J*5~pIe08pYU>NPX)2xF;zU@j!nM5cQu0?UGb!eOMk&hWHM7YpW=TYii@&s zU`rA`Ft+^&5});iE_p2PDRHCm=Ai%eWCJrhz;IUDXXFR~1*j1;!WLI5mcF(m)V*{s zs3nfMi)74rUzHJLBx`5PF%Y@w5sD~>CUZ|UI0-lmetT^{nK3}^ z(iY>A$|v-Z1mfGlCnrZLH0`c72fYedy-JrIBiXjtQ5Jj>uL4x%!N1H-^|$coyVy8TqIr}twi^k-mEzL-}bTc>6*=yOkyKFiMcQ9+#>qaPyRXUlyN zpn3SfwK8RiM`^_?(>Bl3y1p3xMYlNm9j@p{37kkeOAjYu7I42fuk8*vby>&Q{k8U3D*f@+6H}BC#~Pip}+4p`QGSP;N0$9bHfz6qTjF zc>s~wz+4`bKaIc)emhbaPeP#~u?j`@B;9;`0l9P0!Y8aMPf0cj+#CR!3^x-StA<;7 z{IGwGO|k#gwj1ov>>gkT-#i%=ep`5*&VtrAO@1F*mk>z!Y`wRbEK=D;#-0Bd3Ea zmiMehpKV*oV`sq#^ z)D~`@s2$+E5fZVGva3x2W+f^)`IQkY#QeC?R>oyT{fB~0f`fh*^7lpE$7)wF!xLN6 zJ|S)bfoV#{5h6r6VzbV>r~~dtB=X>|2Z=W6yB;d$*YvCoVvo;PpPKf(o=HY13zyQ# z$NJ@F*%qG1c)^XTjNrlcilLSpP!5rUYio%5*-}ADA>5#u*bDX$ND?f`oaE_9`QsPN zE(YH}!iS#4C&eK{BFbW)#fZfS3o!b&^xqwt8GPig>#@P6gOw2xLe+TIfep>kkub&f zfndHiXKYmSpr!iks++e?hw&j7sJ1fNtOF|A3QpfuPvqgjWx#^OcjK))S?1RhPzYg& ztDZKYg{2-}O>ZEY?T&h5DMX)f>+jQyVc8c|p6wzy-ijA*&|OhiQwUqFFgn)ZLRxQ= zQL6H`6+Q;qm-o2kF~LKzI1qL-wI-$d(G64D+O@Sao{!?-%}q=NKeDmx{xtnaMm~Wk^XmL~3UE ze4|1Ctaw+&^pT=Dkdglc(Z9SjEr(^7iI^T5??DDwfbX-BAXKrB%GX%gM{hO<_=!W+ z_D9V7&5|0V5RMuSA54OlRzuretGsmfwn0!!#4sfMZ80_C;-r?M<8$-j%>4QKdK}p2 zp%d245n2d>zA$gQz3^gxx5^&ZLRrSHyI1cmy*R^`qT6kFJ|`Rr)U2fzNN&iiZX9Iz zoSvfi%OEuoDz^Bc3_QIcQ;S6MOBxTpN^-WSE9? z;#T6E&T?lu_MPi$9m;JSGSkv}zsE)_I=*L(@n7(|6)ZU7Tt`T$m=%ouS5#xof6pQDrC2GeW&{att(2cf^OyMA9T zL%x4`rRx9of$~>(3M?uY9+@WcZfL?VG}Vc3@bJk#W_cLdb>EL@Yi!K(6}p*vJ^gD2 zcqeLblogIAFoTkP#~YyXaZ?t0+U$JZjBWe=x3KZolQ7*R_heIhd8o3pav3^5bYpI7 zwe6t zw|P@l+k&B_7B=tx3Db$6zHXg!N^#!jbFL!Mqr+*WccI*^a;3q>XkdRu%P31Ej{A0mnFAC#53$@+z8ohA@47?=OU4}>9trdZfTpe5)7 zDb7)y7COBZ+O%)Hm83ND-;YTWBsu|czUsLLgu6s^e{>I!@v-wUPYm=?^(``6o@jSd zD}K3-Ar=zpXB$AXI91z}U%G1m`yxa?935y#z~DdycL1(Fi@?6wR7X5L04%VYBnda_ zK+u7N(5l>SD*A|g(ejQT`Px5$)c^J`1?dHmSK9;% ze!F;UNfUpY#wLiwHx9j+`>nXNQxjK4GkWVOPV@lx6N|~gLnW1I?zDRhL^YGjUz+*z z)+Y^qWm@JC6wZh*514K(;>v3(+7USyk|BAbh}=PaGZ5(q;9Zq#I{mGNMfE1yE7dR0 z-c*UoGM0`(5~oW?V_^cH&hv0G`v@ zKDW5-?b7n9j}|!ba4tXa-*O=2Pno%9y@Kxk(M&hPd)#Kjq@%F0|QWR(1^$osz zAz9GBpMMw#>#W)0t?P1}dOieU5aL)eG^TjGZ6}}H2I0dOLP+MkukRb|UKYg4=p`~T zn@$!uF>sDP=v~II76@79E3Jo~VRM9LCJ4-9IOILf=kp8gRCKS?22_P4|VZ9PH*s zhfG}t{1R`G;<24Xx4v%wIvf;2WAm~K?mu(?GtZT^#t)OpTeoqDyEm`L?0IOVA#~?) z^joZI>flCW)KTD+&5Q+JHos6%ynVebQ$BR6VS@o)oMf(oWdyB-3A2h()ihQ~9SLX4 zdy=iBg1X%WZ(EdLdckB3s;i0Hcwq;q*Mr2>L zz@5KOg`qu$d3t+B z!7vf>A!5VD;g6`p=0;|v0n=`IRoJ_OSVQ%Wr=9em5$@R&hw$$U%2azCpia~SB>hS8 z3~0bNevX@qi;Ino&1Mcp9vTKJ zTKLQmT@Zth!i`}UuHp#siS2bzdT*#o_k93%i68Mq?N%_!hnJo-2RL!V#~+-L5T~x<%_V)2O(#o3ePwkHSTyvKEv$tG<*+s6Qco8*|WXa>@iq9b$ zV-BziS=RRg?D&(d18Qhf;dk-y9QAJ1OfNFqh4grCs;Ado(b}DN`ILj-q!Hem-)-RZ zxWPHN`Aw*baehaMpk4Hnh3suC*^S})JYO%MLQZ{?xD9}|+pVqXkk}*Y&RCAzNgxbxx6atg^ql1~3& zG-uspVo4~xe`@agUY3*kH1!#qpuCt*y_mF9@BJPMynplk9`I{}j3aSB9z($u2})mW zJ1go$5Ub{dHN~%YaLUBZZMT!v2I1q!nMsi=hHAp<#h6@&TO}4OJ~%g;(OMf4O1p#eVKJcNR#;*^+a}#8|xoi zQMJdu4BUP}St9e@;^>yS@H>U3-1?obe&t0{R4yM0rvQ^WElc}2^k%sr==?Lb#n5Pr zH@(8W61a~axC_ReC){;X7XNE=AGhr4qbl+^@!buqk4xm4mIg?6y*;MB_03(FFFIz~&TM7^z&whOvsT067{p z8U*n^2v5ivR%WX9F+;tIjV@mhazLnA9*9C6(GVhZUS(d)w!$13fLZs8$z@4bZ za>E_IkF~G$h*ka9<-7(wF#h(of~3mZrPd*2-bNXI+)y6zU8 zt*a;h9dSnsa1$V%PFMK&9T9E%T96{0@O9Dt7dLA|MK)_1r2~@0LoaY|`}N&i&6O|P z+d=zs(~6o1CHkG%Q~U-Y^uPnY0}nap(^;zHt;2A%>MdkR&3)muUgQc&4>XqNS|IKb z;wW&mc3=7Con~uw{-%dP)twzSi?m$phj;=0>Cy9R(^qd~aO~ZaZ_+mHQ?z!TEatc# zi~-<^4xkVMup5c6^)GSn8#|B2>tPCppEtG(>D&p7nu;46Rm zYxeNWFt{!Cq8{;H{sbl@pZAv(aSfD#xVXf6?t7ibm~?c6m?#;bZ%9LJF|Cwy6yR8= z3k=*XbWxp&jMZQ06za=Gy!0EeeKY>uY6ZnkqGLaZB9-vvOkESePeb})wfGCk6Ks>n zV+Ms1ZI+{GclF^zd>%Jj4kj+)*(n=s!4hBEtO?s`?!D%Qb znLff^&B-^v!mp%H``s8blm~oANumr@=fHz7CBMPDb<)r7 zB-28kE`CQ*??`_!Ip9@y{En~Fir3$pP!Ec{Fxfla zD;^tY#B=n2mZA3y0#)eAgjagvm4NLOqk8#5SCE^2Y@FDJR;ht0F&6;*RYVkCo;7yh zT02UHe*%?=vgvW7fv62Kxq7}_z~`*XA&mqxVKB|}H1w{MkSCLf!y7x3@?n%#M@VP)uk zGL%EL-*%U67hrvw;EgW#)fp!W$GYJGNGRCx3+>&W7u9i3Z@c|J%IXHD_&GwW@)mO= z*tx)Kzx0z7NlE@=OENNIxzcQmq6ab_C~k6d&q=r2n5^5&9E!ndi6Hzxwt+oX#B`V)tGsGD~0-m zsol##oH4lbz2Kw3whnf#qpI2`svLk~2zzUbS01Yo2BQhK$EVB1xdUe>8^wMh3b*?5 z+W;@!)k2@d1Xl$=p0BS7{XL^~Q%JU^8)rp93 zk-h*`53<_X>c`nxv9o@+`)l#Hj8es~hMI@;IZ^S8o9FPc&}}|7hP0OGWHY)1lCx`= zrlz|9wfn_qaqCmb&bm6gEsK>0m89uqOxoMqh7j zYX&hdCv8z}WAppt*6j!QO-I2Rv52+0@%M_x$`;toKGhU2hdoyPST;w7&U*f%kR^-bSKmi(QB&{r z7mjhnc60Kcj=em;cfHm08!gRx876mnp2DX-ESL_O)q%NdpIEjlx9&=H95;N+k4z3e zH@y_>4QvkX@3Mv3!NH^Vr${|b-|0st^!0y3lk0yCn#i5PgN`hISjO|yjNla@${q0j+!KHiv` zHCJUqX`;%Ff^*b_A#U;Rn&&e4^&flpE9Ok6L1OKPo&lft@T5gtE5jDXo;44{~D2g6+jGpIz0r?Vhh$ zRHgiScsExRkf>RlZQE4-C|I$Nqt z9~EihvA9Qj+Ehal1UO+&e|Uq^0K;dpQwUyAUfPed3Zx_(dOM4mnUXEdQ!yt0g!Q8h zE&2sc@HE5N;3KRtb$R8wi|cWbu}ixprIJxqOZ47*z#H_=dnoe~Z}{Dfmn>a0h=yCf z&8yvHbTv=RgLh^kIG1sC6nFe}E!ZB*MG4r*8+y*Uj1!?t!CN2Rm+*eD) zOyi;ro2PsN1bWOA2Z%Kz7us=a&%^ru+idmofP+U50#f(8bub8@S;`apeF};IN^yXd zx6UO$$9$-0m!cq7eP7q4^-Jx*zFF=hUe{e{Z>LSt-ihhD?Fq>GYyP8>4GN4|q@6qbZ?Ca)LB?nOQ>X|xdnA*EL=G#4}PQ4^Em?<+|dTk8qg z(C^o{k>M*zsR}DCy&ga+w!Loy&YHZm@UQ1ZCcHc^xQxoRFW1Vho1v3;+bC@O2`1Nf zj>NwH`S|N>lnnDcO_+pOHlet)qRWiw4r$Qp%l+l)WKd|~jN{o!HV!?Gn<#0LqGuM{ zACbUu6+nAv5Fgvj%UoJFA{G_|InRP0)X0!3DgU#Pb$kxkQ>@(Q104t3`{F9UfZrs?|6mFCg;{W} z%J_WZ-^{%!$F6pa{su+Lvee-9|E|Q1*`8J>ooeUuQLAz4rRN$5dEBKuX?r_2U(4Io zF!l7^rs)@aqRLNN3{*pbG9%u!XNWFzxRxJ}l4ORgRgtcDG4fx>v&F+LJSJtL=`IXi zLV(|AhPCnXGiZ_A(xid^w}*hnowqmPC~SpXiHmDebGO!91n_#e`YNQ)4!iYKL$bpE z=(UtL1awucX`Lsf0BwiO;!&z9CffM^Lac&u9PxgCqrf#6PrpAFa`OzAkBfC&#j`?a z56Fw0ZTRbpFBQGGtk$%Q6V(s5x5ds%8MCE(5gEpIZvFJ(>S_#^th{km^P)#kx;Qd- zwU^}BZYo0SRgwA7WPb5IM6LCG;rBZzN;d=-h=jcziw5$JC z+UqqV&d(7rsyJBFrqK|J%+G7cpuFN-QL|czgfVbKqe;d@5;-vIAknHeQ82MtpEC8d z&KnhqFkvrkT~#w*)Y(`+2^_F&*HBs2E9THeE?!oi%L-8A8sX@dX>13aaf?@lV8@#~ zHglC3%aznFnzI?9Mt(Kus4X=uixrAuTT)xg;@C<+C2Q`=NZ&;5E2O7S(>a~=MJfg6 zZxnWXK1~Z>9U@QBQgkLS^Tt66m`UOf0C5Q?!}nRbNjxIhtA`Io^Ysb_x*~|@I#G{= znkwf<)^c-k|1w6nJn8OGViYJ=m4rIY@fQ?&EQIH*L_v(jCxE;f+x<2`G;AZF+OuT< z^hPVg1RT^U(O*#Wau@1&J(usBt53y9su!e*L;-`k@PxFzhXfGO4G0TRp=R^R<>3wT zI&<@lrC1iZgb79%4H`^is->nNNN1!w?kiPRdTK7D3224(H>ytQf;*nKfyCfNsuB_I ztW;@vux)5EvBCLaf6dc8OXZqBb`bUdvs%=oAHd7*#sOW|5BSLmCmf3i^h*T(?wEH7 zIt{{WK=&81qc@%k$s_+Wlm+ODDwtD`$R{J4)GajVzG^o9DTpQm!)42j+pcwQJT+{S zQqdEs3^oX4#0pH+LP{w=bX5_41=ugo?w7xXkXkAt@ofpf_ZMLl3<*<1^%OfQjfpA@ z1c(8f+ISW)t=eY3Ianm7@|r@A0<)odDGlqghN|52WL4!`B3ojyLuJ?e-NP;&EHzk! zJ1a`sa?u;EQZ;L(FkZnHCdvrPSPB1X766S8vRQ4Mt}54RD6K+TTWDRX5}-Zs_K30% zn6|0dG*A_Z5g^JCY*W2UAg-JGHdE+kW>&k5D)T#YfSaRUZ#@;Kq>u9q_@Qb5EOO71 z1YPw>Ohk_BkvqyI1SdcF>_&s8w+ltdPosUD2l5}i(fm#3 ziT|3SB*biSw>5oB?1aH6__nVt-EL_){PhtlDtP*?CuPx#`h)^m7JKwq4j=u4&}sbmbo8P`Z~hU;43#Pve=ufN&}yPCu?4LYs@~ zs2SZ`rc-})DwbwfA>~up2A!(X^Og%K64aI;2UHj!Zhz%4T{~8Jg2A>7oifV5s=URWQL@`GXeW9P*uKL_pk8OM;DZ>QAM4T4$}z>GI%Y ze|}dM`uez#OC;@&6awHY@I(0s3*H2Be^y|e^9K0eP7rr~8VFyU@{&{LB<9JG8v>9HFMAAL#m z-$RH!%Wx_aHVLV#;CD?czEIJL^wH}J;y}zY>oK8Or2>{Oz=)LMxQpy-rLd-L z@*Jp{LocmEWH^6iXin__SYo*7A|7b<#-Pj5FPQP$?L%`DfmWz);RYzhepNAfTFPTZK$ zY4t@NC99LMZs;g-!JEH6trT`#K0&yjpaHf=1rg$za{sAW09pOmIt>4fwI}IM9RVx= z(}DYUlUg$+O++W^k5w&hC?3$4{gR1RQPj4hIxy(w`t!w*=qFzFApJM#Y^3;u7T1NU`6vfB42^O@pmQ@;D* zgRJq9hhKaVGUeK&xH<-UzW6^>-{)Zy&QXvV@XLX~+{u*Qwim+%PE6Zm?{X&H zMT}8z$c0ePLWg#W3i0j)F2X|OD5R!rkypVuaCsMGr$O=@r{2ARzd-;iq}b}Cx>-6 z)P0PwtnYt`RCwyP4AwZ5B5m6@^4s2QhQzmh9yz~08W6($97_bQnOZT}f3O@P$HXjg z7Al;VfQ1fjG76g)(@FER&;rO+X4xTOm1X_)jE#v|{BmEBpiUp*Y2iisbShAK31adG zQxENF?xiH#POfi@(BGbZPBspb9+aawTWu3N?kIXAoCbJGHyyGm&6Qx!s+YLV6A2)Q zv?$zid0Vm=$Po&8Eu*qm$@2w}xX>0X0IVhIh5|BzP~B?#Np|dU_2F+NY=Onaz!A6- zKWxT|EfKe{!E!iXoT_Ln#M6Wi*Ezm+N(?@45Dx5cb{ET0TUCKdhl7S&I~=-YmPcUucv+!yaSr~$$`~eH$fl%SYy#6dp|bA z+u2NhJ8NTgK``sO6sXKw=AgG*8(&xXb0JQ~YxFk86m?t^PfUhkV-bIbE*Dd!Lx=BH zbx`-Sbj#o#&ZmanLQ0GL@T-AxF4xZDQy-*JCHP^j-Qo*^oOS1Hz`n=v26~7-Lm|Hx ztx<6AqjK0$9p{?rHuoPzdVZ$L8W_#OxP`-7iC$xjCt43?Gcr z`FtPaC-9$mV(4e|$Hk(qjG)BsnzHbH3ntNIlr*6>oa$;@iN2bw);JDPI(8J zq@cb*rMmLKrPqf8j%Az^A|j<^fr?eble!q5_-H$@KZf`Z{z>LKpRcqHcnB|pb>70q z^{+8OQ-t&6M0uF`blqb@!)=!HHa|$Fy4k9q+|Tru&)UJ zP2!7LcNvFB8UY{wMK2uc%O5dRn}yL9<+U06a}M-tJfKG-Pxx9m#G;_HAqqA0X`hXD+*)vL>IAxKcm)lD3J;x@9Rh4xlth8$x+3RqJMTKJ1|CV4EC;3&^u*sx*ujm6e zKtHnx58Dd|U^cBv%3x;$jXng;ldJeX_R{jS5e28Ue68T%c^x@>+mp~_r-P|;o#l)G zTjhC1Wmy&4+1)$mL&6|1cZCp6_2#aJ8vXu;I%Fgino4bRtx|YUoAv8Pdk2u6A zBssXX(o;3!wc0FJY87X*^A#COWMMpPaEskj+#STB%GdOTFk(v z@OLw}>B7I$|mUfkW?-6>9ScXti$?(VL^-62S^FaL9{zpInGc`|t>duC5|X1%|) zUKD?L_!k%}iJ^?3-V8rEl+8!NQLYHY*=`worsES}+5$%l=c9FZip;f2Dg{F>2%Jc<{8!XaZ(pFtTytvnNcRw7H6ycwo~tPf0w zK-A_x=_s@b1O)h9yD>%JM`D{WlK>HgG)8h;9wk)FR$u9!Z296Iw28cuf0U|x%X(q~ zI4lv*mX=k|KcR&1EsOTiD$VOTmx8=dy149~-UQ@9LxdatUYyY)a(Xb_w3ZO^xQWW= z8qG~uxSBrKm;h88G$!Zks|ujPDq#JK{hOZp?1>U|rVtk_*JZ*_az$?mf0~Yp_ch`Q z)KrZpOfBM&qTpi zgHsiyTs)|i=)JM7uBiLEe!i&~W&6^{(tRPP{!ypWAvU6xJnzkF!u!zsoL`dsy}k!*sZfNJC#J3^q-trlw3Kgf zc2Bl-&$O^@zOJdev`M_2T7CyTzN;Zfy)FA}l(4j1*v$86-I{h+xA(c$4#Hz%^;*9F ztQS=#((`hcnJP1V3EY$F?yLrgp2ons@z4KU%Ui{H|DOKjqd0G}|7jsklGWrg@?9Gt zb}_^b?^y&bbUI675R#GWgr3GYD1Rtm<%?IoVXZyo&dR$XS^@W;Lc!)++Ia4dZwTlDhw$0-NVWn z!kZ~Hx7&KcdnXMjev>i^N>W%jgy@Iatzaigoq`PRgA#zpnc6Ut=me*bVZ9O$#_wIF zFG~qZB@DAj)36m4M1jhG?gJ?pDB(R+$Ip=+oAQT=4#~1RTjO(90~s7fq4?Q~1B|#0ZW%1FS{20)WC<+k+Yc$0!nj)%>*~#_oD8kKX0ZmHGkV5+;MANzpp5GR~ zWWiw|oAD@^d$}-vTAo6vm*U+!jR)rNTbT-FIG**OQgxFgH+!it*65e%c_O_LhdTik z-smA>INEN|Btd%S*tM@=I6H#IaKS`UrC1)2c@}h9p9`e9ZQi*wN?Cn5@F@nzJFspq zf{lzPeZH2&%j|dA(?>uU3Mmon;uk?bVVuebC36#vT8S6fawV~w0;q;|PIEDbPcBwB z4^`G@C}INCM*+os5=@)bIRSK8bCI>__ z!3fq3Wjqgk^cH`q#WE{r4BU&2bXH8Ub@f|N1!6Z;LOd+yuliuT&`BTK*gc-?#lcJjYYM^3lX-~y+bnb6W19?l z{ngp~#DyOImF$+k`PsPj{^GM#F6I`<^ER&K9-yOn;6OdoVX3lkqE$yMIN1fL`P4Ng z*Gng8IB0*?H14;Xh6^5@q!}q8qs5Z=nhz^VF=L%q9_VH67=(zsdi})y==)x)s%e|A z9(R>M0gOcVP5A0stG&G^=X*H|c;hfJnaI?Yu)@HW_pK$*pBl2Ab&h^m==Ahl>?#zw z#=&~HDoS&d@&Leb1<7UpnF7xOq2ouD?NJW@E3k!V4^yImp+A>x6h#UTs_U}zN zu|g>KOE@>J#6w6==E>eZHQ=KSZtAT_-AMRRIe+()G)=iW{EGy^BDDT-01(WYFd7V zcMK`0Uh!>1raHBXYyGo0i151{_`-s@5Js3H1baen9QG3OsM57thTB5f&Q{V|o+lHp z(y#GaUO!vI5N2%4wR5+8q>caAuG3%M=S8VM%l&C%{TCCs&x?tqsx(LH*%j182p|iX z9RNF7xY)<{mpMx7jrc_ZVARsx+z@uc;}wJC0{F@(9~AzhFd@oPs7MvvTm%AfzT5XJ zTg!)#L`R(7z)q}hJ`2|h<>;b$5rCzQQlTW4g6NvxG4EF;Q0#lapun5^wM3LA<>6ah zAg9olx3$rOaq6!U3Ecm#GT#4uBCg~CIgOWvVqU_tk5c4#B-0ETb@)6p5Z0ZKB#_~> z0wSOxlQooiNsNgrxg!y>dIiyetZ zN4gj>#MWF;d`Bo8rC;{AJPmq}SB5Nc+Skw8{w);9*JnaYg$6&9!UW7Fk^m+9sq^Be z=u3J$4^n0#og%7Nd=-lXrafGJ4wg3(h%?c+*`_x+=RKZQYp?C4KK_M@W!FDER4pA= zK5=Y5NExo5x1A$yc>ik;hPn;{E7KTMqOw{SUvqNujWag*{N#^)awGNod3ly$|5bOG zJ@GJ=KH+~atdSg&i8xy1f}!WH=ct5dOs&bkKPPyGA;v8gIWYtqtg`UX=(Gp{vZOI~ z*5G*LGY_CKII8gmYN_{;<^1D~<1Gb!Nl&*v1dM`$_kQE1z#ypVamUc}H+|WL0hZQ- z5LsO1O+p3yg_imvzx&b)^Du!)85ZzK_ear0VRzIzq$jw(v_>ZgoS<*xPuLpo=|P>5 z1iMn2&wo3CIh_z633z{$P#%T-lUMO8<%{akTu79PS%iw$3kkKPLR6`oVhnie=`L4$BLI40ZWWv zVl{~4DE?;Sb8+}ct^aJ|%cmivT7WDCJofF1(?HFRh+SPF%lv5>l7R52vXYY;R>Ui> zCyhG16I$~54>vPJm&*^$q$jGqh|%Y2jJTggLp4W=5n$aEjQ^t;euxGEiR}7mc8pTD zb8nZRJ}Fy@b-vQyG?GM6F$nunFfY&55nbngl{Sys$RW_-V!ayBR@Ngb_~kPa4_@SJ zouszsF`U4O1x6Dh6`{Pk#qPH}F~UQG~q}$_fLP2YOA+r@bl2f^Q7mP^E?$)7L@^qw)OI`ny4P?-VnTl zRJ(9|e6g0plqfAN)l;ES7-;JB-tt|iC8Z?YCa-5J+H}$Pe6gi3WE~#_3aVwS@pAo| zh#~6#^1%fM9G;pI0NFHpe;s*(&wHhn8!YstK3^WOynJ?A9J^qbop5elJj9DUh^WAI zrq$bF8Y)uwI@43%M?a{*SE~nv`Y3qwoHy>N7!F#iHRx>)gK6yIek+|LxU<;K6HfYjJ7jUUxZwRiJYx^ptS|?3 z1PTw628O}~is1O=k zS^w8aJtDOiG4b=Ad_=rm|;kzUf8BAuL~#2}id8hr^uq>%KnKxcg`vw%x^S8l`4} zsc-^!iq}7oud?+!hfdKudk3Ywwa0TO8sW1TQgnp%(dTx3^We8sG`?Aqa?aZrQgX>E zew}y+{i8xqiRyQ{nwZ-*b1AhqNNymESdU}Ar$VRW%h|vfB7)9XAM@puVeF-+Tjs>5 zk^;mala8t?SgmB01_AYKEL>%Xs@>*X6~9e2+so*l7NSc~yE8$8O3nj|VS(%JFC(ht zfb;vfzL&AS=9}lX@>Yn+qsC(&TraW6{*0ah}n;y{-C_2Vec5s>Ro;IX@Jvi+rlD^ zuV*;Lp!JChwrMHQrddohIdGA+ssZ>Es1Kq})l^owT+C-=i~q#SA(=5w;3O6v*Ow1_ zR%Bmy@^%Z`UBjL?W+E*ZsywTgIt>~vMfHp;#Ykh5_(&}m9JcnZD;}F46#4mWjZ z8gFJ*jYZkmCT3v>e@~2#h=Gq^+=TJqIk5rViZHwS%OOv!l_gIrY0w)bbwZYDLuKjT zFyJ3dyT9Xh@0NWf#@l{b=YgI`$nWwTLGf5_-$QDrs!JngEp;`5HmyI;ng2 zEKMjgV1j5v+uzS>AhIia!+GD&4*2il27BamW6L1~O=cntVI7Uuq}k(*jz?33E@%?t zQ`2n#Q4j-GAhT;^kSxQ_rs6oKGL4Pi_&w@mSMnc!i{U9CqsY8oZxl-e#0FbhV=N@f zjx?my>a{b?$;K72RnQesD%(z))!NmG?09!&rDtyf^sxLa@N%A`g)|?Me(oj}ZAdVe z`TOT#4`4>BP%}5-l_89aB;@vXKKUmm}_&yj}x4(b{@*Y%!hT*%Zo2#?8o_@w$t8j zTuI*{aZ+GpmL+5&VKZZ3o_ib|cd8*FUt#8@doZQ6IEE$suQgHrZJcmXw=ld%kjGFp2^h`1eq<4sP}@<9Y*JDOB)+ZDyZY4Y z;R6h135Mn`FjI$sZog~vUzuZVEl_TE8|`)z$#Y&Aku#W?PNx0DQCkD+s}^vth{`tn zR$EOKEY^M-m)aHT6v2SC%M zPrO8JB{Odm#=t3qY=-iuygZ8*=bEs)ksc;EZo=z>xgP!$HgBJK^{(QPrzV9T)B2)8 zi~r8kub%&cZ#lRmssMFzWo^#S@xLgp@b-#mB4ox1UQg=3KWHp#hy`>mzvx3F2El@2 z*flo@F>TT3>)%D$!y;|gzwDP$RmX_9E?su4D*!EgH3O=*^m$iPx3#at2rLjDGT6w! zBV%b*xQ73V2E+;Zs+KqXuE8gey{2~O5D7 zTw3wa3r)ve6h}07os@yqsEBZ-0TvD5&Cib;ozx z^gX_?OW+g2{Sc?U_JavS-~4_OA;Kur^*tDvn71hy^rck}4H%CwPYn;j^r!KRlpU7N zVH}NBM-$GXZ|6XgEzdimIx`G)L;Bt5J+e#Q#BX z96EUV8BAy(WtY<8qc&qMh1(L zn{(X0dRpf^T7RGTS<*Ik>#R>t%;JGu{OV~MxV8ma5$%8D?U?yhSeUs;^8 z=<;QH?_1ix*c#zpg!jR$2akv#wu(N@^l{Vrsl`H9l;%9&=CB0p5I%qd+6MlPphQe{ zvbQROgsxjnTb?{?1z)jMQ6FOb-T~VU%JQ-&=nPp&?QeX*?+XpXzeXm z$r5JTp)4;ryo2V(XJgCx11+&+)v+|0ETyXp4dzn*xAGGO2d~3JX?b3FntZP;ZdI1H z8uw&>mCV_*!X$V#m-)IZz{>P_g_AMg?Ji%V=&@aP+Jv8&L;U?^no_*yPhNGbxeEWX zw@5H}U*(d}_ILp<|8F@upfe_9D>I@thSLUorEx4|AEQX}l~MF#l} zvfaNjL0G_ejMX1SMG{B+{AC~UMGo0%d@RK~r%{9p|1tDhe;Jpy-16sTeQ2M{$C zN8v8UzZy@YXOHpgd8?4=pW2;2EbNb)I|g+B;~&b2cMLti`OF1?I*v|#`{aqr<*t$i z@wV>u{M>9-Wl|sY_(waRw{@5so{^*t#?~La;rM5TbJOT&4YvY{Yh0`8a-O{M6Qj74d}(?JDH$f zYI(VMwM08{V%zdxes7r)TVzupQoTBWY`tvQj><<#;TdtGgVt$nO|>}9)s)$UC35@dXAN8@tJrd z?Z`O~8U2Qi6368y`cVqv=KP4j6x$}Eza=#IgjA#teJ;e_jspeRQ`JbWjkS(a0B>1f z+yvR_A^x}@U64S7Pu{%VQ2~^iUQ3}>vW&a0R_`iT;o|CpSBkO9XWYcsU`);G4w{Q( zxnPYK2LL_Sw7)dt<#1KW)KUyGFP?V6+Yitq?zc&-l{FUHU*m?awX@R`NeAEj#;u;~ zw7Pu^dZ7(7Y}1qVHIY}IZab*N)i)V*xk)Uf=~`^Qsq?Xr8?z84O zjLDQxfvKnd-fUtjjsaz1`p`o{8rsL)xu;f#6gcjkB&nsznhiMv?wPzZ8^C`MNl$&z zCZg$K_7$Tn2~H@-qaSjqZV#V9WK1WHcOfu`CPV~DMatKUmfEl^hvzaX-;rc{=nw01#zucJjD>56O}&EgGD5nd1<^UI4;?-!)VGPfaO=g-xU!m}F#xFF0y zQ6!sj9$Lb9gIL?7gXc1qisk_&T$9Q(LLv7bBjonUfr|)bWBEo_ng%csTnIdH;GbyG zD7?^ME1CkZpH)+iv(YdVU~iMtlD~wU?oNXWhEyM*+DB~rw!hEug0rIbN%+~pK~-}PPaCX%lc05i)nxF-f3Z&gpAD|;gyRFs z&fdS;6!>d$^_~>5lFN7$Z?W9jkrG=i%>}J%18xinBH*y8pj0z6D80lZV4XaP3+o6Y z(UM)$d%Z0%+x_j;MfyJ+_klo;#`8e$|A;;A#U_*Xae! za%gG8dz`o$I+()j*Mx&h%VfyWdC5(X_@8tv#yxq-917#H!BOew9-coHnj_QtUzGY_ zgubDn@w%&iu)<7|z%&DBve`(%<8!$KQphL#<`EZ_iO3)cHI~gPpeu!%JV7H?lljD4 z3PRfYYGfG{s>B|-?3~|C2iXMq{uK(|Q8t|TxUv|nW{?VW%kJD~)+`E2ik_<{?Iti; zhzGOKXfgXeQaLiMS1H}Vm?f}fRBURZktHIBU5f@5h$)R8#pH>wrsCxEQ?UL*&uJhM%U$1bO+G0AC6# zb}|P`+rP&&;MM8-037iFM1GR2@UEt_vKkOapNDlFE& z3|nmdS#e5KTYT&wp_3lFFPIQ%v7^Vm_3Gn^{EQNs(sy9}Z!!c0>sBe>0x4q66nv%R zlH{+&XsGEn6ZG}3;*WmEeE8bs*1xFbi11MbFMth=*M;Yi)+MT9Qn0f z8~n}j0g}7~G?FtS>#|1u0`*M~i8>#FXnk!@I)VzE6*up;cV@%Fb}P&qB%W{ZF^iJrI43K{nv@8n z^WN+QFOuXho%$G9s$F=~?|&zc0nlf)Eyc8(dHp%7b5Ylg!KT?n#xnKMm%|kg`W%x) zGj(9&Rk%aTN39%mIg$i_FH|&$9M2~C%gHh|ifoNL@GwKxLD;R~R8<{rO2NUCmBPU^9^TrCU{F@56FfGRqsew}Yw zO>u)nn!wcB?XX4aCu3GZ3)iU$@%Oz`fxbQIR04vMjg4W6U?|c`oZP%ITh~0apb1I> zOi+AMI6B)dQm*kVG_*plielG0SCOzUdYXQIr3_S@&Bl#tilYg{38##O;B z0P$(p&2&ZeXVKAi!t;mkJDz*eu}b}}nc9p3(g;pGpRLukt$JGg>tIZ23j8dKq$vH` zCewa@QB%t!o}PMFxrq9chW$UGU%y-y0c(~UdwkB#8tPN$pWWTIZp|t#^3souy@x$& z(9v?`xkoMk!q%;S4pwJk=B}?lTO}U%6UXBk^jH4NLMt2S5TSYyC~_zM8X;4rj>YrRL&bTzXDU6jUtoX?w!qL#|yfzvG< z^WX$I+O#W1^*l?0b{;vBPgf>rU#vx}Nt=CWMdj@h-hBL7ueJ}Nc#}Obx$Z|Ebp@$d zCAml~@`H1-=$QjIm)Js{5n;TQNHRm0vZC`J$=cI#X@fejj5PYU<~@*4mipWW-a>k@VTWMV$@3d#o6PZKq<+obv){@o}Mq%CT)h>Tu_ zR?mw1UKoh*)7pSqBluhc$as$$)_Pj_X1;j9=)Uv7?zDVXCi?Jg1V6`l)G5 zb37QY!40VRI*altoPI`u{}V4svg}cdL!v)_$`F0T!hx4suGcr}y?|M>%~aC#^i~e=(OjAqf<9#Zy>#cz6D8brn0(k&H!Oz%OtD LhZsP_An^YI=}F(l diff --git a/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment.md b/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment.md index 97dec0c215..80c1a38048 100644 --- a/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment.md +++ b/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment.md @@ -1,63 +1,47 @@ --- -title: Provision PCs with common settings -description: Create a provisioning package to apply common settings to a PC running Windows 10. +title: Create a provisioning package (desktop wizard) +description: Create a provisioning package to apply common settings to a PC running Windows. ms.topic: how-to -ms.date: 12/31/2017 +ms.date: 07/09/2024 --- -# Provision PCs with common settings for initial deployment (desktop wizard) +# Create a provisioning package (desktop wizard) -This topic explains how to create and apply a provisioning package that contains common enterprise settings to a device running all desktop editions of Windows client except Home. +This article explains how to create and apply a provisioning package that contains common enterprise settings to a device running all desktop editions of Windows client except Home. You can apply a provisioning package on a USB drive to off-the-shelf devices during setup, making it fast and easy to configure new devices. -You can apply a provisioning package on a USB drive to off-the-shelf devices during setup, making it fast and easy to configure new devices. +The following wizard options provide a simple interface for configuring common settings for desktop and kiosk devices: -## Advantages +- [Instructions for the desktop wizard](#start-a-new-project) +- [Instructions for the kiosk wizard](../assigned-access/overview.md) +- [Instructions for the HoloLens wizard](/hololens/hololens-provisioning#provisioning-package-hololens-wizard) +- [Instructions for the Surface Hub wizard](/surface-hub/provisioning-packages-for-surface-hub) -- You can configure new devices without reimaging -- Works on desktop devices -- No network connectivity required -- Simple to apply - -[Learn more about the benefits and uses of provisioning packages.](provisioning-packages.md) - -## What does the desktop wizard do? - -The desktop wizard helps you configure the following settings in a provisioning package: +In this example, we use the **Provision desktop devices** option which helps you configure the following settings in a provisioning package: - Set device name - Upgrade product edition - Configure the device for shared use -- Remove pre-installed software +- Remove preinstalled software - Configure Wi-Fi network - Enroll device in Active Directory or Microsoft Entra ID - Create local administrator account - Add applications and certificates ->[!WARNING] ->You must run Windows Configuration Designer on Windows client to configure Microsoft Entra enrollment using any of the wizards. +> [IMPORTANT] +> You must run Windows Configuration Designer on Windows client to configure Microsoft Entra enrollment using any of the wizards. -Provisioning packages can include management instructions and policies, installation of specific apps, customization of network connections and policies, and more. +## Start a new project -> [!TIP] -> Use the desktop wizard to create a package with the common settings, then switch to the advanced editor to add other settings, apps, policies, etc. -> -> :::image type="content" source="images/icd-simple-edit.png" alt-text="In the desktop wizard, open the advanced editor."::: +1. Open Windows Configuration Designer: From either the Start menu or Start menu search, type **Windows Configuration Designer**, and then select the **Windows Configuration Designer** shortcut. -## Create the provisioning package - -Use the Windows Configuration Designer tool to create a provisioning package. [Learn how to install Windows Configuration Designer.](provisioning-install-icd.md) - -1. Open Windows Configuration Designer (by default, %windir%\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\ICD.exe). - -1. Click **Provision desktop devices**. +1. Select **Provision desktop devices**. :::image type="content" source="images/icd-create-options-1703.png" alt-text="In Windows Configuration Designer, see the ICD start options."::: -1. Name your project and click **Finish**. The pages for desktop provisioning will walk you through the following steps. +1. Name your project and select **Finish**. The pages for desktop provisioning walk you through the following steps. :::image type="content" source="images/icd-desktop-1703.png" alt-text="In Windows Configuration Designer, select Finish, and see the ICD desktop provisioning."::: - > [!IMPORTANT] > When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. @@ -74,6 +58,9 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L - **Configure devices for shared use**: Select **Yes** or **No** to optimize the Windows client for shared use scenarios. - **Remove pre-installed software**: Optional. Select **Yes** if you want to remove preinstalled software. + > [!NOTE] + > To target devices running versions earlier than Windows 10, version 2004, ComputerName customization must be defined from the setting path: `Accounts/ComputerAccount/ComputerName` from the advanced editor. The default path from the simple editor uses a new CSP that isn't available on older systems. + 1. Set up the network: :::image type="content" source="images/set-up-network-details-desktop.png" alt-text="In Windows Configuration Designer, turn on wireless connectivity, enter the network SSID, and network type."::: @@ -81,7 +68,7 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L If you want to enable network setup, select **Set up network**, and configure the following settings: - **Set up network**: To enable wireless connectivity, select **On**. - - **Network SSID**: Enter the Service Set IDentifier (SSID) of the network. + - **Network SSID**: Enter the Service Set Identifier (SSID) of the network. - **Network type**: Select **Open** or **WPA2-Personal**. If you select **WPA2-Personal**, enter the password for the wireless network. 1. Enable account management: @@ -91,10 +78,11 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L If you want to enable account management, select **Account Management**, and configure the following settings: - **Manage organization/school accounts**: Choose how devices are enrolled. Your options: + - **Active Directory**: Enter the credentials for a least-privileged user account to join the device to the domain. - **Microsoft Entra ID**: Before you use a Windows Configuration Designer wizard to configure bulk Microsoft Entra enrollment, [set up Microsoft Entra join in your organization](/azure/active-directory/active-directory-azureadjoin-setup). In your Microsoft Entra tenant, the **maximum number of devices per user** setting determines how many times the bulk token in the wizard can be used. - If you select this option, enter a friendly name for the bulk token you get using the wizard. Set an expiration date for the token. The maximum is 180 days from the date you get the token. Select **Get bulk token**. In **Let's get you signed in**, enter an account that has permissions to join a device to Microsoft Entra ID, and then the password. Select **Accept** to give Windows Configuration Designer the necessary permissions. + If you select this option, enter a friendly name for the bulk token retrieved using the wizard. Set an expiration date for the token. The maximum is 180 days from the date you get the token. Select **Get bulk token**. In **Let's get you signed in**, enter an account that has permissions to join a device to Microsoft Entra ID, and then the password. Select **Accept** to give Windows Configuration Designer the necessary permissions. You must run Windows Configuration Designer on Windows client to configure Microsoft Entra enrollment using any of the wizards. @@ -123,6 +111,11 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L - **Protect your package**: Select **Yes** or **No** to password protect your provisioning package. When you apply the provisioning package to a device, you must enter this password. -After you're done, click **Create**. It only takes a few seconds. When the package is built, the location where the package is stored is displayed as a hyperlink at the bottom of the page. +After you're done, select **Create**. It only takes a few seconds. When the package is built, the location where the package is stored is displayed as a hyperlink at the bottom of the page. - **Next step**: [How to apply a provisioning package](provisioning-apply-package.md) +## Next steps + +> [!div class="nextstepaction"] +> Learn more about applying a provisioning package: +> +> [Apply a provisioning package](provisioning-apply-package.md) diff --git a/windows/configuration/provisioning-packages/provision-pcs-with-apps.md b/windows/configuration/provisioning-packages/provision-pcs-with-apps.md index fd7134875e..2052ee0f96 100644 --- a/windows/configuration/provisioning-packages/provision-pcs-with-apps.md +++ b/windows/configuration/provisioning-packages/provision-pcs-with-apps.md @@ -2,21 +2,21 @@ title: Provision PCs with apps description: Learn how to install multiple Universal Windows Platform (UWP) apps and Windows desktop applications (Win32) in a provisioning package. ms.topic: how-to -ms.date: 12/31/2017 +ms.date: 07/09/2024 --- # Provision PCs with apps You can install multiple Universal Windows Platform (UWP) apps and Windows desktop applications (Win32) in a provisioning package. This article explains the various settings in [Windows Configuration Designer](provisioning-install-icd.md) for app install. -When you add an app in a Windows Configuration Designer wizard, the appropriate settings are displayed based on the app that you select. For instructions on adding an app using the advanced editor in Windows Configuration Designer, see [Add an app using advanced editor](#adv). +When you add an app in a Windows Configuration Designer wizard, the appropriate settings are displayed based on the app that you select. For instructions on adding an app using the advanced editor in Windows Configuration Designer, see [Add an app using advanced editor](#add-a-windows-desktop-application-using-advanced-editor). ->[!IMPORTANT] ->If you plan to use Intune to manage your devices, we recommend using Intune to install Microsoft 365 Apps for enterprise 2016 apps (Access, Excel, OneDrive for Business, OneNote, Outlook, PowerPoint, Publisher, Skype for Business, Word, Project Desktop Client, and Visio Pro for Microsoft 365 Apps for enterprise). Apps that are installed using a provisioning package cannot be managed or modified using Intune. [Learn how to assign Microsoft 365 Apps for enterprise 2016 apps using Microsoft Intune.](/intune/apps-add-office365) +> [!IMPORTANT] +> If you plan to use Intune to manage your devices, we recommend using Intune to install Microsoft 365 Apps for enterprise. Apps that are installed using a provisioning package cannot be managed or modified using Intune. [Learn how to add Microsoft 365 Apps to Windows devices with Microsoft Intune.](/intune/apps-add-office365) ## Settings for UWP apps -- **License Path**: Specify the license file if it is an app from the Microsoft Store. This is optional if you have a certificate for the app. +- **License Path**: Specify the license file if it's an app from the Microsoft Store. This is optional if you have a certificate for the app. - **Package family name**: Specify the package family name if you don't specify a license. This field will be autopopulated after you specify a license. - **Required appx dependencies**: Specify the appx dependency packages that are required for the installation of the app @@ -24,32 +24,23 @@ When you add an app in a Windows Configuration Designer wizard, the appropriate ### MSI installer +- **Command line arguments**: Optionally, append more command arguments. The silent flag is appended for you. Example: PROPERTY=VALUE +- **Continue installations after failure**: Optionally, specify if you want to continue installing more apps if this app fails to install +- **Restart required**: Optionally, specify if you want to reboot after a successful install of this app +- **Required win32 app dependencies**: Optionally, specify more files that are required for the installation of the app. For installers that have multiple file dependencies or have directory structures, [create a cab file of the assets](provisioning-script-to-install-app.md#cab-the-application-assets). The installation script should [include expansion of the .cab file](provisioning-script-to-install-app.md#cab-extract). + > [!NOTE] > You can find more information about command-line options for Msiexec.exe [here](/windows/win32/msi/command-line-options). -- **Command line arguments**: Optionally, append more command arguments. The silent flag is appended for you. Example: PROPERTY=VALUE - -- **Continue installations after failure**: Optionally, specify if you want to continue installing more apps if this app fails to install - -- **Restart required**: Optionally, specify if you want to reboot after a successful install of this app - -- **Required win32 app dependencies**: Optionally, specify more files that are required for the installation of the app. For installers that have multiple file dependencies or have directory structures, [create a cab file of the assets](provisioning-script-to-install-app.md#cab-the-application-assets). The installation script should [include expansion of the .cab file](provisioning-script-to-install-app.md#cab-extract). - ### Exe or other installer - **Command line arguments**: Append the command line arguments with a silent flag (required). Optionally, append more flags - -- **Return Codes**: Specify the return codes for success and success with restart (0 and 3010 by default respectively) Any return code that is not listed will be interpreted as failure. The text boxes are space delimited. - +- **Return Codes**: Specify the return codes for success and success with restart (0 and 3010 by default respectively) Any return code that isn't listed is interpreted as failure. The text boxes are space delimited. - **Continue installations after failure**: Optionally, specify if you want to continue installing more apps if this app fails to install - - **Restart required**: Optionally, specify if you want to reboot after a successful install of this app - - **Required win32 app dependencies**: Optionally, specify more files that are required for the installation of the app. For installers that have multiple file dependencies or have directory structures, [create a cab file of the assets](provisioning-script-to-install-app.md#cab-the-application-assets). The installation script should [include expansion of the .cab file](provisioning-script-to-install-app.md#cab-extract). - - -## Add a Windows desktop application using advanced editor in Windows Configuration Designer +## Add a Windows desktop application using advanced editor 1. In the **Available customizations** pane, go to **Runtime settings** > **ProvisioningCommands** > **PrimaryContext** > **Command**. @@ -61,50 +52,32 @@ When you add an app in a Windows Configuration Designer wizard, the appropriate ![enter settings for first app.](images/wcd-app-commands.png) -## Add a universal app to your package +## Add a universal app to your package using advanced editor -Universal apps that you can distribute in the provisioning package can be line-of-business (LOB) apps developed by your organization, Microsoft Store for Business apps that you acquire with [offline licensing](/microsoft-store/acquire-apps-windows-store-for-business), or third-party apps. This procedure will assume you are distributing apps from the Microsoft Store for Business. For other apps, obtain the necessary information (such as the package family name) from the app developer. +Universal apps that you can distribute in the provisioning package can be line-of-business (LOB) apps developed by your organization, Microsoft Store for Business apps that you acquire with [offline licensing](/microsoft-store/acquire-apps-windows-store-for-business), or non-Microsoft apps. This procedure assumes you're distributing apps from the Microsoft Store for Business. For other apps, obtain the necessary information (such as the package family name) from the app developer. 1. In the **Available customizations** pane, go to **Runtime settings** > **UniversalAppInstall**. - 1. For **DeviceContextApp**, specify the **PackageFamilyName** for the app. In Microsoft Store for Business, the package family name is listed in the **Package details** section of the download page. - 1. For **ApplicationFile**, select **Browse** to find and select the target app (either an \*.appx or \*.appxbundle). - 1. For **DependencyAppxFiles**, select **Browse** to find and add any dependencies for the app. In Microsoft Store for Business, any dependencies for the app are listed in the **Required frameworks** section of the download page. - 1. For **DeviceContextAppLicense**, enter the **LicenseProductID**. - - In Microsoft Store for Business, generate the unencoded license for the app on the app's download page. - - - - Open the license file and search for **LicenseID=** to get the GUID, enter the GUID in the **LicenseProductID** field and select **Add**. - - 1. In the **Available customizations** pane, select the **LicenseProductId** that you just added. - 1. For **LicenseInstall**, select **Browse**, navigate to the license file that you renamed *\*.**ms-windows-store-license**, and select the license file. [Learn more about distributing offline apps from the Microsoft Store for Business.](/microsoft-store/distribute-offline-apps) -> [!NOTE] +> [!IMPORTANT] > Removing a provisioning package will not remove any apps installed by device context in that provisioning package. - - ## Add a certificate to your package 1. In the **Available customizations** pane, go to **Runtime settings** > **Certificates** > **ClientCertificates**. - 1. Enter a **CertificateName** and then select **Add**. - 1. Enter the **CertificatePassword**. - 1. For **CertificatePath**, browse and select the certificate to be used. - 1. Set **ExportCertificate** to **False**. - 1. For **KeyLocation**, select **Software only**. ## Add other settings to your package @@ -113,15 +86,15 @@ For details about the settings you can customize in provisioning packages, see [ ## Build your package -1. When you are done configuring the provisioning package, on the **File** menu, select **Save**. +1. After you configure the provisioning package, on the **File** menu, select **Save**. 1. Read the warning that project files may contain sensitive information, and select **OK**. - When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location, and delete the project files when they're no longer needed. + When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files aren't encrypted. Store the project files in a secure location, and delete the project files when they're no longer needed. 1. On the **Export** menu, select **Provisioning package**. -1. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.** +1. Change **Owner** to **IT Admin**, which sets the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.** 1. Set a value for **Package Version**. @@ -130,8 +103,7 @@ For details about the settings you can customize in provisioning packages, see [ 1. Optional. In the **Provisioning package security** window, you can choose to encrypt the package and enable package signing. - - **Enable package encryption** - If you select this option, an auto-generated password will be shown on the screen. - + - **Enable package encryption** - If you select this option, an autogenerated password is shown on the screen. - **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by selecting **Select...** and choosing the certificate you want to use to sign the package. > [!TIP] @@ -145,36 +117,21 @@ For details about the settings you can customize in provisioning packages, see [ 1. Select **Build** to start building the package. The project information is displayed in the build page and the progress bar indicates the build status.

If you need to cancel the build, select **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations Page**. -1. If your build fails, an error message will show up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again.

- If your build is successful, the name of the provisioning package, output directory, and project directory will be shown. +1. If your build fails, an error message shows up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again. If your build is successful, the name of the provisioning package, output directory, and project directory is shown. - If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, select **Back** to change the output package name and path, and then select **Next** to start another build. - - - - If you are done, select **Finish** to close the wizard and go back to the **Customizations Page**. + - If you're done, select **Finish** to close the wizard and go back to the **Customizations Page**. 1. Select the **output location** link to go to the location of the package. You can provide that .ppkg to others through any of the following methods: - Shared network folder - - SharePoint site - - Removable media (USB/SD) - - Email -**Next step**: [How to apply a provisioning package](provisioning-apply-package.md) +## Next steps -## Related articles - -- [Provisioning packages for Windows client](provisioning-packages.md) -- [How provisioning works in Windows client](provisioning-how-it-works.md) -- [Install Windows Configuration Designer](provisioning-install-icd.md) -- [Create a provisioning package](provisioning-create-package.md) -- [Apply a provisioning package](provisioning-apply-package.md) -- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md) -- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md) -- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md) -- [PowerShell cmdlets for provisioning Windows client (reference)](provisioning-powershell.md) -- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md) -- [Create a provisioning package with multivariant settings](provisioning-multivariant.md) +> [!div class="nextstepaction"] +> Learn more about applying a provisioning package: +> +> [Apply a provisioning package](provisioning-apply-package.md) diff --git a/windows/configuration/provisioning-packages/provisioning-apply-package.md b/windows/configuration/provisioning-packages/provisioning-apply-package.md index 2f8bb266e1..a5e44cee63 100644 --- a/windows/configuration/provisioning-packages/provisioning-apply-package.md +++ b/windows/configuration/provisioning-packages/provisioning-apply-package.md @@ -2,7 +2,7 @@ title: Apply a provisioning package description: Provisioning packages can be applied to a device during initial setup (OOBE) and after (runtime). ms.topic: how-to -ms.date: 12/31/2017 +ms.date: 07/09/2024 --- # Apply a provisioning package @@ -13,22 +13,20 @@ Provisioning packages can be applied to a device during initial setup (out-of-bo > > - Applying a provisioning package to a desktop device requires administrator privileges on the device. > - You can interrupt a long-running provisioning process by pressing ESC. - -> [!TIP] -> In addition to the following methods, you can use the PowerShell cmdlet [Install-ProvisioningPackage](/powershell/module/provisioning/Install-ProvisioningPackage) with `-LogsDirectoryPath` to get logs for the operation. +> - In addition to the following methods, you can use the PowerShell cmdlet [Install-ProvisioningPackage](/powershell/module/provisioning/Install-ProvisioningPackage) with `-LogsDirectoryPath` to get logs for the operation. ## During initial setup To apply a provisioning package from a USB drive during initial setup: -1. Start with a device on the initial setup screen. If the device has gone past this screen, reset the device to start over. To reset, go to **Settings** > **System** > [**Recovery**](ms-settings:recovery) > **Reset this PC**. +1. Start with a device on the initial setup screen. If the device goes past this screen, reset the device to start over. To reset, go to **Settings** > **System** > [**Recovery**](ms-settings:recovery) > **Reset this PC**. :::image type="content" source="images/oobe.png" alt-text="The first screen when setting up a new PC."::: 1. Insert the USB drive. If nothing happens when you insert the USB drive, press the Windows key five times. - If there's only one provisioning package on the USB drive, the provisioning package is applied. See step 5. - - If there's more than one provisioning package on the USB drive, Windows setup recognizes the drive and ask how you want to provision the device. Select **Install provisioning package** and select **Next**. + - If there's more than one provisioning package on the USB drive, Windows setup recognizes the drive and asks how you want to provision the device. Select **Install provisioning package** and select **Next**. :::image type="content" source="images/provisioning-oobe-choice.png" alt-text="What would you like to do?"::: @@ -36,11 +34,11 @@ To apply a provisioning package from a USB drive during initial setup: :::image type="content" source="images/provisioning-oobe-choose-package.png" alt-text="Choose a package."::: -1. The selected provisioning package will install and apply to the device. +1. The selected provisioning package is applied to the device. :::image type="content" source="images/provisioning-oobe-installing.png" alt-text="Setting up your PC."::: -1. Wait for the device to load and begin applying the provisioning package. Once you see "You can remove your removable media now!" you can remove your USB drive. Windows will continue provisioning the device. +1. Wait for the device to load and begin applying the provisioning package. After you see "You can remove your removable media now!" you can remove your USB drive. Windows continues to provision the device. ## After initial setup @@ -60,7 +58,7 @@ Provisioning packages can be applied after initial setup through Windows setting :::image type="content" source="images/provisioning-runtime-add-package.png" alt-text="Select and add a package."::: -1. Provisioning packages require administrator privileges as they can modify system policies and run scripts at the system level. Ensure you trust the package you're installing before accepting the UAC prompt. Select **Yes**. +1. Provisioning packages require administrator privileges as they can modify system policies and run scripts at the system level. Ensure you trust the package you're installing before accepting the User Account Control (UAC) prompt. Select **Yes**. :::image type="content" source="images/provisioning-runtime-UAC.png" alt-text="Do you want to allow changes to your device?"::: @@ -83,16 +81,3 @@ To apply a provisioning package directly, such as from a USB drive, folder, netw 1. The provisioning runtime asks if the package is from a source you trust. Verify that you're applying the correct package and that it's trusted. Select **Yes, add it**. :::image type="content" source="images/provisioning-runtime-trust.png" alt-text="Do you trust this package?"::: - -## Related articles - -- [Provisioning packages for Windows client](provisioning-packages.md) -- [How provisioning works in Windows client](provisioning-how-it-works.md) -- [Install Windows Configuration Designer](provisioning-install-icd.md) -- [Create a provisioning package](provisioning-create-package.md) -- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md) -- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md) -- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md) -- [PowerShell cmdlets for provisioning Windows client (reference)](provisioning-powershell.md) -- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md) -- [Create a provisioning package with multivariant settings](provisioning-multivariant.md) diff --git a/windows/configuration/provisioning-packages/provisioning-command-line.md b/windows/configuration/provisioning-packages/provisioning-command-line.md index 12a10ae502..5ff3a5cf1d 100644 --- a/windows/configuration/provisioning-packages/provisioning-command-line.md +++ b/windows/configuration/provisioning-packages/provisioning-command-line.md @@ -1,20 +1,17 @@ --- title: Windows Configuration Designer command line interface -description: Learn more about the ICD syntax, switches, and arguments that you can use in the Windows Configuration Designer command line interface for Windows10/11 client devices. +description: Learn more about the ICD syntax, switches, and arguments that you can use in the Windows Configuration Designer command line interface for Windows devices. ms.topic: how-to -ms.date: 12/31/2017 +ms.date: 07/09/2024 --- -# Windows Configuration Designer command line interface (reference) +# Windows Configuration Designer command line interface You can use the Windows Configuration Designer command line interface (CLI) to automate the building of provisioning packages. - IT pros can use the Windows Configuration Designer CLI to require less retooling of existing processes. You must run the Windows Configuration Designer CLI from a command window with administrator privileges. - - You must use the Windows Configuration Designer CLI and edit the customizations.xml sources to create a provisioning package with multivariant support. You need the customizations.xml file as one of the inputs to the Windows Configuration Designer CLI to build a provisioning package. For more information, see [Create a provisioning package with multivariant settings](provisioning-multivariant.md). - - ## Syntax ``` cmd @@ -29,25 +26,9 @@ icd.exe /Build-ProvisioningPackage /CustomizationXML: /PackagePath: | Switch | Required? | Arguments | | --- | --- | --- | | /CustomizationXML | No | Specifies the path to a Windows provisioning XML file that contains the customization assets and settings. For more information, see Windows provisioning answer file. | -| /PackagePath | Yes | Specifies the path and the package name where the built provisioning package will be saved. | +| /PackagePath | Yes | Specifies the path and the package name where the built provisioning package is saved. | | /StoreFile | No


See Important note. | For partners using a settings store other than the default store(s) used by Windows Configuration Designer, use this parameter to specify the path to one or more comma-separated Windows settings store file. By default, if you don't specify a settings store file, the settings store that's common to all Windows editions is loaded by Windows Configuration Designer.


**Important** If you use this parameter, you must not use /MSPackageRoot or /OEMInputXML. | | /Variables | No | Specifies a semicolon separated `` and `` macro pair. The format for the argument must be `=`. | | Encrypted | No | Denotes whether the provisioning package should be built with encryption. Windows Configuration Designer autogenerates the decryption password and includes this information in the output.

Precede with `+` for encryption, or `-` for no encryption. The default is no encryption. | | Overwrite | No | Denotes whether to overwrite an existing provisioning package.

Precede with + to overwrite an existing package or - if you don't want to overwrite an existing package. The default is false (don't overwrite). | | /? | No | Lists the switches and their descriptions for the command-line tool or for certain commands. | - - -## Related articles - -- [Provisioning packages for Windows client](provisioning-packages.md) -- [How provisioning works in Windows client](provisioning-how-it-works.md) -- [Install Windows Configuration Designer](provisioning-install-icd.md) -- [Create a provisioning package](provisioning-create-package.md) -- [Apply a provisioning package](provisioning-apply-package.md) -- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md) -- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md) -- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md) -- [PowerShell cmdlets for provisioning Windows client (reference)](provisioning-powershell.md) -- [Create a provisioning package with multivariant settings](provisioning-multivariant.md) - - diff --git a/windows/configuration/provisioning-packages/provisioning-create-package.md b/windows/configuration/provisioning-packages/provisioning-create-package.md index 0824710f19..b239dfb3d5 100644 --- a/windows/configuration/provisioning-packages/provisioning-create-package.md +++ b/windows/configuration/provisioning-packages/provisioning-create-package.md @@ -1,16 +1,14 @@ --- -title: Create a provisioning package -description: Learn how to create a provisioning package for Windows 10/11, which lets you quickly configure a device without having to install a new image. +title: Create a provisioning package (advanced) +description: Learn how to create a provisioning package for Windows, which lets you quickly configure a device without having to install a new image. ms.topic: how-to -ms.date: 12/31/2017 +ms.date: 07/09/2024 --- -# Create a provisioning package +# Create a provisioning package (advanced) You can use Windows Configuration Designer to create a provisioning package (`.ppkg`) that contains customization settings, and then apply the provisioning package to a device running Windows client. ->[Learn how to install Windows Configuration Designer.](provisioning-install-icd.md) - > [!TIP] > We recommend creating a local admin account when you develop and test your provisioning package. We also recommend using a *least privileged* domain user account to join devices to the Active Directory domain. @@ -18,29 +16,14 @@ You can use Windows Configuration Designer to create a provisioning package (`.p 1. Open Windows Configuration Designer: From either the Start menu or Start menu search, type **Windows Configuration Designer**, and then select the **Windows Configuration Designer** shortcut. -1. Select your desired option on the **Start** page, which offers multiple options for creating a provisioning package, as shown in the following image: +1. Select **Advanced provisioning** on the start page, which offers multiple options for creating a provisioning package, as shown in the following image: ![Configuration Designer wizards.](images/icd-create-options-1703.png) - - The following wizard options provide a simple interface for configuring common settings for desktop and kiosk devices: - - - [Instructions for the desktop wizard](provision-pcs-for-initial-deployment.md) - - [Instructions for the kiosk wizard](../kiosk-single-app.md#wizard) - - [Instructions for HoloLens wizard](/hololens/hololens-provisioning) - - [Instructions for Surface Hub wizard](/surface-hub/provisioning-packages-for-surface-hub) - - Wizards are also available for creating provisioning packages for Microsoft Surface Hub and Microsoft HoloLens devices. For a summary of the settings available in the desktop and kiosk devices, see [What you can configure using Configuration Designer wizards](provisioning-packages.md#configuration-designer-wizards). - - - >[!NOTE] - >To target devices running versions earlier than Windows 10, version 2004, ComputerName customization must be defined from the setting path: `Accounts/ComputerAccount/ComputerName` from the advanced editor. The default path from the simple editor uses a new CSP that isn't available on older systems. - - - The **Advanced provisioning** option opens a new project with all the runtime settings available. (The rest of this procedure uses advanced provisioning.) - - >[!TIP] - > You can start a project in the simple wizard editor and then switch the project to the advanced editor. - > - > ![Switch to advanced editor.](images/icd-switch.png) + > [!TIP] + > You can start a project in the simple wizard editor and then switch the project to the advanced editor. + > + > ![Switch to advanced editor.](images/icd-switch.png) 1. Enter a name for your project, and then select **Next**. @@ -48,7 +31,7 @@ You can use Windows Configuration Designer to create a provisioning package (`.p | Windows edition | Settings available for customization | Provisioning package can apply to | |---|---|---| - | All Windows editions | Common settings | All Windows client devices | + | All Windows editions | Common settings | All Windows client devices | | All Windows desktop editions | Common settings and settings specific to desktop devices | All Windows client desktop editions (Home, Pro, Enterprise, Pro Education, Enterprise Education) | | Windows 10 IoT Core | Common settings and settings specific to Windows 10 IoT Core | All Windows 10 IoT Core devices | | Windows 10 Holographic | Common settings and settings specific to Windows 10 Holographic | [Microsoft HoloLens](/hololens/hololens-provisioning) | @@ -67,7 +50,10 @@ For an advanced provisioning project, Windows Configuration Designer opens the * ![What the ICD interface looks like.](images/icd-runtime.png) -The settings in Windows Configuration Designer are based on Windows client configuration service providers (CSPs). To learn more about CSPs, see [Introduction to configuration service providers (CSPs) for IT pros](./how-it-pros-can-use-configuration-service-providers.md). +The settings in Windows Configuration Designer are based on Windows client configuration service providers (CSPs). To learn more about CSPs, see [Introduction to configuration service providers (CSPs) for IT pros](how-it-pros-can-use-configuration-service-providers.md). + +> [!NOTE] +> To target devices running versions earlier than Windows 10, version 2004, ComputerName customization must be defined from the setting path: `Accounts/ComputerAccount/ComputerName` from the advanced editor. The default path from the simple editor uses a new CSP that isn't available on older systems. The process for configuring settings is similar for all settings. The following table shows an example. @@ -83,11 +69,11 @@ The process for configuring settings is similar for all settings. The following :::image type="content" source="images/icd-step3.png" alt-text="In Windows Configuration Designer, enter a name for the certificate."::: -1. Some settings, such as this example, require additional information. In **Available customizations**, select the value you just created, and more settings are displayed: +1. Some settings, such as this example, require additional information. In **Available customizations**, select the value you created, and more settings are displayed: :::image type="content" source="images/icd-step4.png" alt-text="In Windows Configuration Designer, additional settings for client certificate are available."::: -1. When the setting is configured, it is displayed in the **Selected customizations** pane: +1. When the setting is configured, it's displayed in the **Selected customizations** pane: :::image type="content" source="images/icd-step5.png" alt-text="In Windows Configuration Designer, the selected customizations pane shows your settings."::: @@ -97,27 +83,26 @@ For details on each specific setting, see [Windows Provisioning settings referen ## Build package -1. After you're done configuring your customizations, select **Export**, and then select **Provisioning Package**. +1. After you configure your customizations, select **Export**, and then select **Provisioning Package**. ![Export on top bar.](images/icd-export-menu.png) 1. In the **Describe the provisioning package** window, enter the following information, and then select **Next**: - - **Name** - This field is pre-populated with the project name. You can change this value by entering a different name in the **Name** field. - - **Version (in Major.Minor format** - Optional. You can change the default package version by specifying a new value in the **Version** field. + - **Name** - This field is prepopulated with the project name. You can change this value by entering a different name in the **Name** field. + - **Version (in Major.Minor format** - Optional. You can change the default package version by specifying a new value in the **Version** field. - **Owner** - Select **IT Admin**. For more information, see [Precedence for provisioning packages](provisioning-how-it-works.md#precedence-for-provisioning-packages). - **Rank (between 0-99)** - Optional. You can select a value between 0 and 99, inclusive. The default package rank is 0. 1. In the **Select security details for the provisioning package** window, you can select to encrypt and/or sign a provisioning package with a selected certificate, and then select **Next**. Both selections are optional: - - **Encrypt package** - If you select this option, an autogenerated password will be shown on the screen. - - **Sign package** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by selecting **Select** and choosing the certificate you want to use to sign the package. + - **Encrypt package** - If you select this option, an autogenerated password is shown on the screen. + - **Sign package** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by selecting **Select** and choosing the certificate you want to use to sign the package. - >[!NOTE] - >You should only configure provisioning package security when the package is used for device provisioning and when the package has content with sensitive security data, such as certificates or credentials that should be prevented from being compromised. When applying an encrypted and/or signed provisioning package, either during OOBE or through the setting UI, the package can be decrypted, and if signed, be trusted without explicit user consent. An IT administrator can set policy on a user device to restrict the removal of required packages from the device, or the provisioning of potentially harmful packages on the device. - - > - >If a provisioning package is signed by a trusted provisioner, it can be installed on a device without a prompt for user consent. In order to enable trusted provider certificates, you must set the **TrustedProvisioners** setting prior to installing the trusted provisioning package. This is the only way to install a package without user consent. To provide additional security, you can also set **RequireProvisioningPackageSignature**, which prevents users from installing provisioning packages that are not signed by a trusted provisioner. + > [!NOTE] + > You should only configure provisioning package security when the package is used for device provisioning and when the package has content with sensitive security data, such as certificates or credentials that should be prevented from being compromised. When applying an encrypted and/or signed provisioning package, either during OOBE or through the setting UI, the package can be decrypted, and if signed, be trusted without explicit user consent. An IT administrator can set policy on a user device to restrict the removal of required packages from the device, or the provisioning of potentially harmful packages on the device. + > + > If a provisioning package is signed by a trusted provisioner, it can be installed on a device without a prompt for user consent. In order to enable trusted provider certificates, you must set the **TrustedProvisioners** setting prior to installing the trusted provisioning package. This is the only way to install a package without user consent. To provide additional security, you can also set **RequireProvisioningPackageSignature**, which prevents users from installing provisioning packages that are not signed by a trusted provisioner. 1. In the **Select where to save the provisioning package** window, specify the output location where you want the provisioning package to go once it's built, and then select **Next**. By default, Windows Configuration Designer uses the project folder as the output location. @@ -125,29 +110,17 @@ For details on each specific setting, see [Windows Provisioning settings referen If you need to cancel the build, select **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations** page. -1. If your build fails, an error message will appear that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again. +1. If your build fails, an error message appears that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again. - If your build is successful, the name of the provisioning package, output directory, and project directory will be shown. + If your build is successful, the name of the provisioning package, output directory, and project directory is shown. If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, select **Back** to change the output package name and path, and then select **Next** to start another build. -1. When you are done, select **Finish** to close the wizard and go back to the **Customizations** page. +1. When you're done, select **Finish** to close the wizard and go back to the **Customizations** page. -**Next step**: [How to apply a provisioning package](provisioning-apply-package.md) +## Next steps -## Learn more - -- [How to bulk-enroll devices with On-premises Mobile Device Management in Microsoft Configuration Manager](/configmgr/mdm/deploy-use/bulk-enroll-devices-on-premises-mdm) - -## Related articles - -- [Provisioning packages for Windows client](provisioning-packages.md) -- [How provisioning works in Windows client](provisioning-how-it-works.md) -- [Install Windows Configuration Designer](provisioning-install-icd.md) -- [Apply a provisioning package](provisioning-apply-package.md) -- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md) -- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md) -- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md) -- [PowerShell cmdlets for provisioning Windows client (reference)](provisioning-powershell.md) -- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md) -- [Create a provisioning package with multivariant settings](provisioning-multivariant.md) +> [!div class="nextstepaction"] +> Learn more about applying a provisioning package: +> +> [Apply a provisioning package](provisioning-apply-package.md) \ No newline at end of file diff --git a/windows/configuration/provisioning-packages/provisioning-how-it-works.md b/windows/configuration/provisioning-packages/provisioning-how-it-works.md index 24c02a6557..ec61311214 100644 --- a/windows/configuration/provisioning-packages/provisioning-how-it-works.md +++ b/windows/configuration/provisioning-packages/provisioning-how-it-works.md @@ -1,13 +1,13 @@ --- -title: How provisioning works in Windows 10/11 +title: How provisioning works in Windows description: Learn more about how provisioning package work on Windows client devices. A provisioning package (.ppkg) is a container for a collection of configuration settings. ms.topic: conceptual -ms.date: 12/31/2017 +ms.date: 07/09/2024 --- # How provisioning works in Windows -Provisioning packages in Windows client provide IT administrators with a simplified way to apply configuration settings to Windows client devices. Windows Configuration Designer is a tool that makes it easy to create a provisioning package. Windows Configuration Designer can be installed from Microsoft Store. +Provisioning packages in Windows client provide IT administrators with a simplified way to apply configuration settings to Windows client devices. Windows Configuration Designer is a tool that makes it easy to create a provisioning package. Windows Configuration Designer can be installed from the Microsoft Store. ## Provisioning packages @@ -30,15 +30,10 @@ You can use provisioning packages for runtime device provisioning by accessing When multiple provisioning packages are available for device provisioning, the combination of package owner type and package rank level defined in the package manifest is used to resolve setting conflicts. The pre-defined package owner types are listed below in the order of lowest to highest owner type precedence: 1. Microsoft - 1. Silicon Vendor - 1. OEM - 1. System Integrator - 1. Mobile Operator - 1. IT Admin The valid value range of package rank level is 0 to 99. @@ -130,16 +125,3 @@ When applying provisioning packages from a removable media attached to the devic When applying multiple provisioning packages to a device, the provisioning engine resolves settings with conflicting configuration values from different packages by evaluating the package ranking using the combination of package owner type and package rank level defined in the package metadata. A configuration setting applied from a provisioning package with the highest package ranking will be the final value applied to the device. After a stand-alone provisioning package is applied to the device, the package is persisted in the `%ProgramData%\Microsoft\Provisioning` folder on the device. Provisioning packages can be removed by an administrator by using the **Add or remove a provisioning package** available under **Settings** > **Accounts** > **Access work or school**. - -## Related articles - -- [Provisioning packages for Windows client](provisioning-packages.md) -- [Install Windows Configuration Designer](provisioning-install-icd.md) -- [Create a provisioning package](provisioning-create-package.md) -- [Apply a provisioning package](provisioning-apply-package.md) -- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md) -- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md) -- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md) -- [PowerShell cmdlets for provisioning Windows client (reference)](provisioning-powershell.md) -- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md) -- [Create a provisioning package with multivariant settings](provisioning-multivariant.md) diff --git a/windows/configuration/provisioning-packages/provisioning-install-icd.md b/windows/configuration/provisioning-packages/provisioning-install-icd.md index 9b572cde75..8acca19051 100644 --- a/windows/configuration/provisioning-packages/provisioning-install-icd.md +++ b/windows/configuration/provisioning-packages/provisioning-install-icd.md @@ -1,15 +1,17 @@ --- title: Install Windows Configuration Designer -description: Learn how to install and use Windows Configuration Designer so you can easily configure devices running Windows 10/11. +description: Learn how to install and use Windows Configuration Designer so you can easily configure devices running Windows. ms.topic: how-to ms.reviewer: kevinsheehan -ms.date: 12/31/2017 +ms.date: 07/09/2024 --- -# Install Windows Configuration Designer, and learn about any limitations +# Install Windows Configuration Designer Use the Windows Configuration Designer tool to create provisioning packages to easily configure devices running Windows client. Windows Configuration Designer is primarily used by IT departments for business and educational institutions who need to provision bring-your-own-device (BYOD) and business-supplied devices. +On devices running Windows client, you can install [the Windows Configuration Designer app](https://www.microsoft.com/store/apps/9nblggh4tx22) from the Microsoft Store. + ## Supported platforms Windows Configuration Designer can create provisioning packages for Windows client desktop, including Windows IoT Core, Microsoft Surface Hub, and Microsoft HoloLens. You can run Windows Configuration Designer on the following operating systems: @@ -18,32 +20,22 @@ Windows Configuration Designer can create provisioning packages for Windows clie - Windows 11 - Windows 10 - x86 and amd64 -- Windows 8.1 Update - x86 and amd64 -- Windows 8.1 - x86 and amd64 -- Windows 8 - x86 and amd64 -- Windows 7 - x86 and amd64 **Server OS**: +- Windows Server 2022 +- Windows Server 2019 - Windows Server 2016 -- Windows Server 2012 R2 Update -- Windows Server 2012 R2 -- Windows Server 2012 -- Windows Server 2008 R2 ->[!WARNING] ->You must run Windows Configuration Designer on Windows client to configure Microsoft Entra enrollment using any of the wizards. - -## Install Windows Configuration Designer - -On devices running Windows client, you can install [the Windows Configuration Designer app](https://www.microsoft.com/store/apps/9nblggh4tx22) from the Microsoft Store. +> [!WARNING] +> You must run Windows Configuration Designer on Windows client to configure Microsoft Entra enrollment using any of the wizards. ## Current Windows Configuration Designer limitations -- When running Windows Configuration Designer on Windows releases earlier than Windows 10, version 2004 you might need to enable TLS 1.2, especially if using Bulk Enrollment Tokens. You may see the error message in the `icd.log` file: `Error: AADSTS1002016: You are using TLS version 1.0, 1.1 and/or 3DES cipher which are deprecated to improve the security posture of Azure AD` For more information, see [Enable TLS 1.2 on client or server operating systems](/troubleshoot/azure/active-directory/enable-support-tls-environment#enable-tls-12-on-client-or-server-operating-systems-). +- When running Windows Configuration Designer on Windows releases earlier than Windows 10, version 2004 you might need to enable TLS 1.2, especially if using Bulk Enrollment Tokens. You may see the error message in the `icd.log` file: `Error: AADSTS1002016: You are using TLS version 1.0, 1.1 and/or 3DES cipher which are deprecated to improve the security posture of Azure AD` For more information, see [Enable TLS 1.2 on client or server operating systems](/troubleshoot/azure/active-directory/enable-support-tls-environment#enable-tls-12-on-client-or-server-operating-systems-). -- Windows Configuration Designer doesn't work properly when the Group Policy setting **Policies** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Security Zones: Use only machine settings** is enabled. When this policy is set, each step will display oversized buttons that fill the **Windows Configuration Designer** window. Additionally, the various options and descriptions that are normally to the right of the buttons won't be displayed because the buttons take up all of the space in the **Windows Configuration Designer** window. To resolve the problem, run Windows Configuration Designer on a device that doesn't have this policy enabled. +- Windows Configuration Designer doesn't work properly when the Group Policy setting **Policies** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Security Zones: Use only machine settings** is enabled. When this policy is set, each step displays oversized buttons that fill the **Windows Configuration Designer** window. Additionally, the various options and descriptions that are normally to the right of the buttons aren't displayed because the buttons take up all of the space in the **Windows Configuration Designer** window. To resolve the problem, run Windows Configuration Designer on a device that doesn't have this policy enabled. - You can only run one instance of Windows Configuration Designer on your computer at a time. @@ -68,17 +60,10 @@ On devices running Windows client, you can install [the Windows Configuration De - **Recommended**: Before starting, copy all source files to the PC running Windows Configuration Designer. Don't use external sources, like network shares or removable drives. Using local files reduces the risk of interrupting the build process from a network issue, or from disconnecting the USB device. -**Next step**: [How to create a provisioning package](provisioning-create-package.md) +## Next steps -## Related articles - -- [Provisioning packages for Windows client](provisioning-packages.md) -- [How provisioning works in Windows client](provisioning-how-it-works.md) -- [Create a provisioning package](provisioning-create-package.md) -- [Apply a provisioning package](provisioning-apply-package.md) -- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md) -- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md) -- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md) -- [PowerShell cmdlets for provisioning Windows client (reference)](provisioning-powershell.md) -- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md) -- [Create a provisioning package with multivariant settings](provisioning-multivariant.md) +> [!div class="nextstepaction"] +> Learn more about creating a provisioning package: +> +> [Create a provisioning package (simple)](provision-pcs-for-initial-deployment.md) +> [Create a provisioning package (advanced)](provisioning-create-package.md) diff --git a/windows/configuration/provisioning-packages/provisioning-multivariant.md b/windows/configuration/provisioning-packages/provisioning-multivariant.md index 6ecb125be7..01be2943f7 100644 --- a/windows/configuration/provisioning-packages/provisioning-multivariant.md +++ b/windows/configuration/provisioning-packages/provisioning-multivariant.md @@ -2,18 +2,18 @@ title: Create a provisioning package with multivariant settings description: Create a provisioning package with multivariant settings to customize the provisioned settings for defined conditions. ms.topic: how-to -ms.date: 12/31/2017 +ms.date: 07/09/2024 --- # Create a provisioning package with multivariant settings -In your organization, you might have different configuration requirements for devices that you manage. You can create separate provisioning packages for each group of devices in your organization that have different requirements. Or, you can create a multivariant provisioning package, a single provisioning package that can work for multiple conditions. For example, in a single provisioning package, you can define one set of customization settings that will apply to devices set up for French and a different set of customization settings for devices set up for Japanese. +In your organization, you might have different configuration requirements for devices that you manage. You can create separate provisioning packages for each group of devices in your organization that have different requirements. Or, you can create a multivariant provisioning package, a single provisioning package that can work for multiple conditions. For example, in a single provisioning package, you can define one set of customization settings that apply to devices set up for French and a different set of customization settings for devices set up for Japanese. To provision multivariant settings, you use Windows Configuration Designer to create a provisioning package that contains all of the customization settings that you want to apply to any of your devices. Next, you manually edit the .XML file for that project to define each set of devices (a **Target**). For each **Target**, you specify at least one **Condition** with a value, which identifies the devices to receive the configuration. Finally, for each **Target**, you provide the customization settings to be applied to those devices. Let's begin by learning how to define a **Target**. -## Define a target +## Target In the XML file, you provide an **Id**, or friendly name, for each **Target**. Each **Target** is defined by at least one **TargetState** which contains at least one **Condition**. A **Condition** element defines the matching type between the condition and the specified value. @@ -43,9 +43,9 @@ The following table shows the conditions supported in Windows client provisionin | PNN | P0 | Supported | String | Use to target settings based on public land mobile network (PLMN) Network Name value. | | GID1 | P0 | Supported | Digit string | Use to target settings based on the Group Identifier (level 1) value. | | ICCID | P0 | Supported | Digit string | Use to target settings based on the Integrated Circuit Card Identifier (ICCID) value. | -| Roaming | P0 | N/A | Boolean | Use to specify roaming. Set the value to **1** (roaming) or **0** (non-roaming). | -| UICC | P0 | N/A | Enumeration | Use to specify the Universal Integrated Circuit Card (UICC) state. Set the value to one of the following:


- 0 - Empty
- 1 - Ready
- 2 - Locked | -| UICCSLOT | P0 | N/A | Digit string | Use to specify the UICC slot. Set the value one of the following:


- 0 - Slot 0
- 1 - Slot 1 | +| Roaming | P0 | N/A | Boolean | Use to specify roaming. Set the value to **1** (roaming) or **0** (nonroaming). | +| UICC | P0 | N/A | Enumeration | Use to specify the Universal Integrated Circuit Card (UICC) state. Set the value to one of these values:
0 - Empty
1 - Ready
2 - Locked | +| UICCSLOT | P0 | N/A | Digit string | Use to specify the UICC slot. Set the value one of these values:
0 - Slot 0
1 - Slot 1 | | ProcessorType | P1 | Supported | String | Use to target settings based on the processor type. | | ProcessorName | P1 | Supported | String | Use to target settings based on the processor name. | | AoAc ("Always On, Always Connected") | P1 | Supported | Boolean | Set the value to **0** (false) or **1** (true). If this condition is TRUE, the system supports the S0 low power idle model. | @@ -53,17 +53,16 @@ The following table shows the conditions supported in Windows client provisionin | SocIdentifier | P1 | Supported | String | Use to target settings based on the Soc Identifier. Available since 25301 OS build version. | | Architecture | P1 | Supported | String | Matches the PROCESSOR_ARCHITECTURE environment variable. | | Server | P1 | Supported | Boolean | Set the value to **0** (false) or **1** (true) to identify a server. | -| Region | P1 | Supported | Enumeration | Use to target settings based on country/region, using the 2-digit alpha ISO code per [ISO 3166-1 alpha-2](https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2). | -| Lang | P1 | Supported | Enumeration | Use to target settings based on language code, using the 2-digit [ISO 639 alpha-2 code](https://en.wikipedia.org/wiki/ISO_639). | +| Region | P1 | Supported | Enumeration | Use to target settings based on region, using the two digit alpha ISO code per [ISO 3166-1 alpha-2](https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2). | +| Lang | P1 | Supported | Enumeration | Use to target settings based on language code, using the two digit [ISO 639 alpha-2 code](https://en.wikipedia.org/wiki/ISO_639). | The matching types supported in Windows client are: -| Matching type | Syntax | Example | -| --- | --- | --- | -| Straight match | Matching type is specified as-is | <Condition Name="ProcessorName" Value="Barton" /> | -| Regular expression (Regex) match | Matching type is prefixed by "Pattern:" | <Condition Name="ProcessorName" Value="Pattern:.*Celeron.*" /> | -| Numeric range match | Matching type is prefixed by "!Range:" | <Condition Name="MNC" Value="!Range:400, 550" /> | - +| Matching type | Syntax | Example | +|-----------------------------------|-------------------------------------------|------------------------------------------------------------------------| +| Straight match | Matching type is specified as-is | `<Condition Name="ProcessorName" Value="Barton" />` | +| Regular expressions (Regex) match | Matching type is prefixed with `Pattern:` | `<Condition Name="ProcessorName" Value="Pattern:.*Celeron.*" />` | +| Numeric range match | Matching type is prefixed with `!Range:` | `<Condition Name="MNC" Value="!Range:400, 550" />` | ### TargetState priorities @@ -76,27 +75,18 @@ Settings that match more than one **TargetState** with equal priority are applie The **TargetState** priority is assigned based on the condition's priority (see the [Conditions table](#conditions) for priorities). The priority evaluation rules are as followed: 1. A **TargetState** with P0 conditions is higher than a **TargetState** without P0 conditions. - 1. A **TargetState** with both P0 and P1 conditions is higher than a **TargetState** with only P0 conditions. - 1. A **TargetState** with a greater number of matched P0 conditions is higher than **TargetState** with fewer matched P0 conditions, regardless of the number of P1 conditions matched. - -1. If the number of P0 conditions matched are equivalent, then the **TargetState** with the most matched P1 conditions has higher priority. - +1. If the number of P0 conditions matched is equivalent, then the **TargetState** with the most matched P1 conditions has higher priority. 1. If both P0 and P1 conditions are equally matched, then the **TargetState** with the greatest total number of matched conditions has highest priority. - - ## Create a provisioning package with multivariant settings Follow these steps to create a provisioning package with multivariant capabilities. 1. Build a provisioning package and configure the customizations you want to apply during certain conditions. For more information, see [Create a provisioning package](provisioning-create-package.md). - -1. After you've [configured the settings](provisioning-create-package.md#configure-settings), save the project. - +1. After you [configure the settings](provisioning-create-package.md#configure-settings), save the project. 1. Open the project folder and copy the customizations.xml file to any local location. - 1. Use an XML or text editor to open the customizations.xml file. The customizations.xml file holds the package metadata (including the package owner and rank) and the settings that you configured when you created your provisioning package. The **Customizations** node of the file contains a **Common** section, which contains the customization settings. @@ -131,10 +121,9 @@ Follow these steps to create a provisioning package with multivariant capabiliti ``` -1. Edit the customizations.xml file to create a **Targets** section to describe the conditions that will handle your multivariant settings. - - The following example shows the customizations.xml, which has been modified to include several conditions including **ProcessorName**, **ProcessorType**, **MCC**, and **MNC**. +1. Edit the customizations.xml file to create a **Targets** section to describe the conditions that handle your multivariant settings. + The following example shows the customizations.xml, which is modified to include several conditions including **ProcessorName**, **ProcessorType**, **MCC**, and **MNC**. ```XML @@ -185,18 +174,15 @@ Follow these steps to create a provisioning package with multivariant capabiliti 1. In the customizations.xml file, create a **Variant** section for the settings you need to customize. To do this: a. Define a child **TargetRefs** element. - - b. Within the **TargetRefs** element, define a **TargetRef** element. You can define multiple **TargetRef** elements for each **Id** that you need to apply to customized settings. - c. Move compliant settings from the **Common** section to the **Variant** section. If any of the **TargetRef** elements matches the **Target**, all settings in the **Variant** are applied. - >[!NOTE] - >You can define multiple **Variant** sections. Settings that reside in the **Common** section are applied unconditionally on every triggering event. + > [!NOTE] + > You can define multiple **Variant** sections. Settings that reside in the **Common** section are applied unconditionally on every triggering event. - The following example shows the customizations.xml updated to include a **Variant** section and the moved settings that will be applied if the conditions for the variant are met. + The following example shows the customizations.xml updated to include a **Variant** section and the moved settings that are applied if the conditions for the variant are met. ```XML @@ -249,10 +235,9 @@ Follow these steps to create a provisioning package with multivariant capabiliti - ``` -1. Save the updated customizations.xml file and note the path to this updated file. You will need the path as one of the values for the next step. +1. Save the updated customizations.xml file and note the path to this updated file. You'll need the path as one of the values for the next step. 1. Use the [Windows Configuration Designer command-line interface](provisioning-command-line.md) to create a provisioning package using the updated customizations.xml. @@ -262,13 +247,10 @@ Follow these steps to create a provisioning package with multivariant capabiliti icd.exe /Build-ProvisioningPackage /CustomizationXML:"C:\CustomProject\customizations.xml" /PackagePath:"C:\CustomProject\output.ppkg" /StoreFile:C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\Microsoft-Common-Provisioning.dat" ``` +In this example, the **StoreFile** corresponds to the location of the settings store that is used to create the package for the required Windows edition. -In this example, the **StoreFile** corresponds to the location of the settings store that will be used to create the package for the required Windows edition. - ->[!NOTE] ->The provisioning package created during this step will contain the multivariant settings. You can use this package either as a standalone package that you can apply to a Windows device or use it as the base when starting another project. - - +> [!NOTE] +> The provisioning package created during this step contains the multivariant settings. You can use this package either as a standalone package that you can apply to a Windows device or use it as the base when starting another project. ## Events that trigger provisioning @@ -276,26 +258,11 @@ When you install the multivariant provisioning package on a Windows client devic The following events trigger provisioning on Windows client devices: -| Event | Windows client for desktop editions | -| --- | --- | -| System boot | Supported | -| Operating system update | Planned | -| Package installation during device first run experience | Supported | -| Detection of SIM presence or update | Supported | -| Package installation at runtime | Supported | -| Roaming detected | Not supported | - - -## Related articles - -- [Provisioning packages for Windows client](provisioning-packages.md) -- [How provisioning works in Windows client](provisioning-how-it-works.md) -- [Install Windows Configuration Designer](provisioning-install-icd.md) -- [Create a provisioning package](provisioning-create-package.md) -- [Apply a provisioning package](provisioning-apply-package.md) -- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md) -- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md) -- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md) -- [PowerShell cmdlets for provisioning Windows client (reference)](provisioning-powershell.md) -- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md) - +| Event | Windows client for desktop editions | +|---------------------------------------------------------|-------------------------------------| +| System boot | Supported | +| Operating system update | Planned | +| Package installation during device first run experience | Supported | +| Detection of SIM presence or update | Supported | +| Package installation at runtime | Supported | +| Roaming detected | Not supported | diff --git a/windows/configuration/provisioning-packages/provisioning-packages.md b/windows/configuration/provisioning-packages/provisioning-packages.md index 050fc24beb..a226b877f3 100644 --- a/windows/configuration/provisioning-packages/provisioning-packages.md +++ b/windows/configuration/provisioning-packages/provisioning-packages.md @@ -1,9 +1,9 @@ --- title: Provisioning packages overview -description: With Windows 10 and Windows 11, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image. Learn about what provisioning packages, are and what they do. +description: With Windows, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image. Learn about what provisioning packages are and what they do. ms.reviewer: kevinsheehan ms.topic: conceptual -ms.date: 12/31/2017 +ms.date: 07/08/2024 --- # Provisioning packages for Windows @@ -12,29 +12,17 @@ Windows provisioning makes it easy for IT administrators to configure end-user d A provisioning package (.ppkg) is a container for a collection of configuration settings. With Windows client, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image. -Provisioning packages are simple enough that with a short set of written instructions, a student, or non-technical employee can use them to configure their device. It can result in a significant reduction in the time required to configure multiple devices in your organization. - - +Provisioning packages are simple enough that with a short set of written instructions, a student, or nontechnical users can use them to configure their device. It can result in a significant reduction in the time required to configure multiple devices in your organization. Windows Configuration Designer is available as an [app in the Microsoft Store](https://www.microsoft.com/store/apps/9nblggh4tx22). - - - - - - - - - - ## Benefits of provisioning packages Provisioning packages let you: - Quickly configure a new device without going through the process of installing a new image. - Save time by configuring multiple devices using one provisioning package. -- Quickly configure employee-owned devices in an organization without a mobile device management (MDM) infrastructure. +- Quickly configure user-owned devices in an organization without a mobile device management (MDM) infrastructure. - Set up a device without the device having network connectivity. Provisioning packages can be: @@ -44,57 +32,7 @@ Provisioning packages can be: - Downloaded from a network share. - Deployed in NFC tags or barcodes. -## What you can configure - -### Configuration Designer wizards - -The following table describes settings that you can configure using the wizards in Windows Configuration Designer to create provisioning packages. - -| Step | Description | Desktop wizard | Kiosk wizard | HoloLens wizard | -| --- | --- | --- | --- | --- | -| Set up device | Assign device name, enter product key to upgrade Windows, configure shared use, remove pre-installed software | βœ… | βœ… | βœ… | -| Set up network | Connect to a Wi-Fi network | βœ… | βœ… | βœ… | -| Account management | Enroll device in Active Directory, enroll device in Microsoft Entra ID, or create a local administrator account | βœ… | βœ… | βœ… | -| Bulk Enrollment in Microsoft Entra ID | Enroll device in Microsoft Entra ID using Bulk Token

[Set up Microsoft Entra join in your organization](/azure/active-directory/active-directory-azureadjoin-setup), before you use Windows Configuration Designer wizard to configure bulk Microsoft Entra enrollment. | βœ… | βœ… | βœ… | -| Add applications | Install applications using the provisioning package. | βœ… | βœ… | ❌ | -| Add certificates | Include a certificate file in the provisioning package. | βœ… | βœ… | βœ… | -| Configure kiosk account and app | Create local account to run the kiosk mode app, specify the app to run in kiosk mode | ❌ | βœ… | ❌ | -| Configure kiosk common settings | Set tablet mode, configure welcome and shutdown screens, turn off timeout settings | ❌ | βœ… | ❌ | -| Developer Setup | Enable Developer Mode | ❌ | ❌ | βœ… | - -- [Instructions for the desktop wizard](provision-pcs-for-initial-deployment.md) -- [Instructions for the kiosk wizard](../kiosk-single-app.md#wizard) -- [Instructions for the HoloLens wizard](/hololens/hololens-provisioning#wizard) - ->[!NOTE] ->After you start a project using a Windows Configuration Designer wizard, you can switch to the advanced editor to configure additional settings in the provisioning package. - -### Configuration Designer advanced editor - -The following table provides some examples of settings that you can configure using the Windows Configuration Designer advanced editor to create provisioning packages. - -| Customization options | Examples | -|---|---| -| Bulk Active Directory join and device name | Join devices to Active Directory domain and assign device names using hardware-specific serial numbers or random characters | -| Applications | Windows apps, line-of-business applications | -| Bulk enrollment into MDM | Automatic enrollment into a third-party MDM service

Using a provisioning package for auto-enrollment to Microsoft Intune isn't supported. To enroll devices, use the Configuration Manager console. | -| Certificates | Root certification authority (CA), client certificates | -| Connectivity profiles | Wi-Fi, proxy settings, Email | -| Enterprise policies | Security restrictions (password, device lock, camera, and so on), encryption, update settings | -| Data assets | Documents, music, videos, pictures | -| Start menu customization | Start menu layout, application pinning | -| Other | Home and lock screen wallpaper, computer name, domain join, DNS settings, and so on | - -For details about the settings you can customize in provisioning packages, see [Windows Provisioning settings reference]( https://go.microsoft.com/fwlink/p/?LinkId=619012). - - - - - - -WCD, simplified common provisioning scenarios. - -:::image type="content" source="images/icd.png" alt-text="Configuration Designer options"::: +## Provisioning scenarios WCD supports the following scenarios for IT administrators: @@ -111,8 +49,54 @@ WCD supports the following scenarios for IT administrators: - MobileIron (password-string based enrollment) - Other MDMs (cert-based enrollment) - - +> [!NOTE] +> The Provision school devices wizard is removed from Windows Configuration Designer. Instead, use the [Setup School PCs app](https://www.microsoft.com/store/p/set-up-school-pcs/9nblggh4ls40) from the Microsoft Store. + +:::image type="content" source="images/icd.png" alt-text="Configuration Designer options"::: + +## What you can configure + +Windows Configuration Designer provides the following simple provisioning scenarios: + +- [Instructions for the desktop wizard](provision-pcs-for-initial-deployment.md) +- [Instructions for the kiosk wizard](../assigned-access/overview.md) +- [Instructions for the HoloLens wizard](/hololens/hololens-provisioning#provisioning-package-hololens-wizard) +- [Instructions for the Surface Hub wizard](/surface-hub/provisioning-packages-for-surface-hub) + +The following table describes settings that you can configure using the wizards in Windows Configuration Designer to create provisioning packages. + +| Step | Description | Desktop wizard | Kiosk wizard | HoloLens wizard | +| --- | --- | --- | --- | --- | +| Set up device | Assign device name, enter product key to upgrade Windows, configure shared use, remove preinstalled software | βœ… | βœ… | βœ… | +| Set up network | Connect to a Wi-Fi network | βœ… | βœ… | βœ… | +| Account management | Enroll device in Active Directory, enroll device in Microsoft Entra ID, or create a local administrator account | βœ… | βœ… | βœ… | +| Bulk Enrollment in Microsoft Entra ID | Enroll device in Microsoft Entra ID using Bulk Token

[Set up Microsoft Entra join in your organization](/azure/active-directory/active-directory-azureadjoin-setup), before you use Windows Configuration Designer wizard to configure bulk Microsoft Entra enrollment. | βœ… | βœ… | βœ… | +| Add applications | Install applications using the provisioning package. | βœ… | βœ… | ❌ | +| Add certificates | Include a certificate file in the provisioning package. | βœ… | βœ… | βœ… | +| Configure kiosk account and app | Create local account to run the kiosk mode app, specify the app to run in kiosk mode | ❌ | βœ… | ❌ | +| Configure kiosk common settings | Set tablet mode, configure welcome and shutdown screens, turn off timeout settings | ❌ | βœ… | ❌ | +| Developer Setup | Enable Developer Mode | ❌ | ❌ | βœ… | + +> [!TIP] +> After you start a project using a Windows Configuration Designer wizard, you can switch to the advanced editor to configure additional settings in the provisioning package. + +## Configuration Designer advanced editor + +The following table provides some examples of settings that you can configure using the Windows Configuration Designer advanced editor to create provisioning packages. + +| Customization options | Examples | +|---|---| +| Bulk Active Directory join and device name | Join devices to Active Directory domain and assign device names using hardware-specific serial numbers or random characters | +| Applications | Windows apps, line-of-business applications | +| Bulk enrollment into MDM | Automatic enrollment into a third-party MDM service

Using a provisioning package for autoenrollment to Microsoft Intune isn't supported. To enroll devices, use the Configuration Manager console. | +| Certificates | Root certification authority (CA), client certificates | +| Connectivity profiles | Wi-Fi, proxy settings, Email | +| Enterprise policies | Security restrictions (password, device lock, camera, and so on), encryption, update settings | +| Data assets | Documents, music, videos, pictures | +| Start menu customization | Start menu layout, application pinning | +| Other | Home and lock screen wallpaper, computer name, domain join, DNS settings, and so on | + +For details about the settings you can customize in provisioning packages, see [Windows Provisioning settings reference]( https://go.microsoft.com/fwlink/p/?LinkId=619012). ## Related articles diff --git a/windows/configuration/provisioning-packages/provisioning-powershell.md b/windows/configuration/provisioning-packages/provisioning-powershell.md index e5e7ea6019..d8292d3413 100644 --- a/windows/configuration/provisioning-packages/provisioning-powershell.md +++ b/windows/configuration/provisioning-packages/provisioning-powershell.md @@ -1,17 +1,14 @@ --- -title: PowerShell cmdlets for provisioning Windows 10/11 -description: Learn more about the Windows PowerShell cmdlets that you can use with Provisioning packages on Windows10/11 client desktop devices. +title: PowerShell cmdlets for provisioning packages in Windows +description: Learn more about the Windows PowerShell cmdlets that you can use with Provisioning packages on Windows devices. ms.topic: conceptual - -ms.date: 12/31/2017 +ms.date: 07/09/2024 --- -# PowerShell cmdlets for provisioning Windows client (reference) +# PowerShell cmdlets for provisioning Windows client Windows client includes Provisioning PowerShell cmdlets. These cmdlets make it easy to script the following functions. -## cmdlets - - **Add-ProvisioningPackage**: Applies a provisioning package. Syntax: @@ -59,7 +56,7 @@ Windows client includes Provisioning PowerShell cmdlets. These cmdlets make it e - `Uninstall-TrustedProvisioningCertificate ` ->[!NOTE] +> [!NOTE] > You can use Get-Help to get usage help on any command. For example: `Get-Help Add-ProvisioningPackage` Trace logs are captured when using cmdlets. The following logs are available in the logs folder after the cmdlet completes: @@ -69,20 +66,5 @@ Trace logs are captured when using cmdlets. The following logs are available in - ProvTrace.<timestamp>.TXT - TEXT file containing trace output formatted for easy reading, filtered to only show events logged by providers in the WPRP file - ProvLogReport.<timestamp>.XLS - Excel file containing trace output, filtered to only show events logged by providers in WPRP file - - ->[!NOTE] ->When applying provisioning packages using Powershell cmdlets, the default behavior is to suppress the prompt that appears when applying an unsigned provisioning package. This is by design so that provisioning packages can be applied as part of existing scripts. - -## Related articles - -- [How provisioning works in Windows client](provisioning-how-it-works.md) -- [Install Windows Configuration Designer](provisioning-install-icd.md) -- [Create a provisioning package](provisioning-create-package.md) -- [Apply a provisioning package](provisioning-apply-package.md) -- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md) -- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md) -- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md) -- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md) -- [Create a provisioning package with multivariant settings](provisioning-multivariant.md) - +> [!NOTE] +> When applying provisioning packages using Powershell cmdlets, the default behavior is to suppress the prompt that appears when applying an unsigned provisioning package. This is by design so that provisioning packages can be applied as part of existing scripts. diff --git a/windows/configuration/provisioning-packages/provisioning-script-to-install-app.md b/windows/configuration/provisioning-packages/provisioning-script-to-install-app.md index c9aff98df4..05fc65f6c1 100644 --- a/windows/configuration/provisioning-packages/provisioning-script-to-install-app.md +++ b/windows/configuration/provisioning-packages/provisioning-script-to-install-app.md @@ -1,8 +1,8 @@ --- title: Use a script to install a desktop app in provisioning packages -description: With Windows 10/11, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image. +description: With Windows, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image. ms.topic: how-to -ms.date: 12/31/2017 +ms.date: 07/09/2024 --- # Use a script to install a desktop app in provisioning packages @@ -57,14 +57,14 @@ Create a script to perform whatever work is needed to install the application(s) You don't need to create an orchestrator script. You can have one command line per app. If necessary, you can create a script that logs the output per app, as mentioned below (rather than one orchestrator script for the entire provisioning package). ->[!NOTE] ->All actions performed by the script must happen silently, showing no UI and requiring no user interaction. +> [!NOTE] > ->The scripts will be run on the device in system context. +> - All actions performed by the script must happen silently, showing no UI and requiring no user interaction. +> - The scripts will be run on the device in system context. ### Debugging example -Granular logging isn't built in, so the logging must be built into the script itself. Here's an example script that logs 'Hello World' to a logfile. When run on the device, the logfile will be available after provisioning is completed. As you'll see in the following examples, it's recommended that you log each action that your script performs. +Granular logging isn't built in, so the logging must be built into the script itself. Here's an example script that logs `Hello World` to a logfile. When run on the device, the logfile will be available after provisioning is completed. As you'll see in the following examples, it's recommended that you log each action that your script performs. ```log set LOGFILE=%SystemDrive%\HelloWorld.log @@ -178,20 +178,14 @@ When you're done, [build the package](provisioning-create-package.md#build-packa 1. The command line will be executed with the directory the CommandFiles were deployed to as the working directory. This means you do not need to specific the full path to assets in the command line or from within any script. 1. The runtime provisioning component will attempt to run the scripts from the provisioning package at the earliest point possible, depending on the stage when the PPKG was added. For example, if the package was added during the Out-of-Box Experience, it will be run immediately after the package is applied, while the out of box experience is still happening. This is before the user account configuration options are presented to the user. A spinning progress dialog will appear and "please wait" will be displayed on the screen. - >[!NOTE] - >There is a timeout of 30 minutes for the provisioning process at this point. All scripts and installs need to complete within this time. + > [!NOTE] + > There is a timeout of 30 minutes for the provisioning process at this point. All scripts and installs need to complete within this time. 1. The scripts are executed in the background as the rest of provisioning continues to run. For packages added on existing systems using the double-click to install, there's no notification that provisioning or script execution has completed -## Related articles +## Next steps -- [Provisioning packages for Windows client](provisioning-packages.md) -- [How provisioning works in Windows client](provisioning-how-it-works.md) -- [Install Windows Configuration Designer](provisioning-install-icd.md) -- [Create a provisioning package](provisioning-create-package.md) -- [Apply a provisioning package](provisioning-apply-package.md) -- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md) -- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md) -- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md) -- [PowerShell cmdlets for provisioning Windows client (reference)](provisioning-powershell.md) -- [Create a provisioning package with multivariant settings](provisioning-multivariant.md) +> [!div class="nextstepaction"] +> Learn more about applying a provisioning package: +> +> [Apply a provisioning package](provisioning-apply-package.md) \ No newline at end of file diff --git a/windows/configuration/provisioning-packages/provisioning-uninstall-package.md b/windows/configuration/provisioning-packages/provisioning-uninstall-package.md index 6615407051..a4f68379ee 100644 --- a/windows/configuration/provisioning-packages/provisioning-uninstall-package.md +++ b/windows/configuration/provisioning-packages/provisioning-uninstall-package.md @@ -1,19 +1,18 @@ --- -title: Uninstall a provisioning package - reverted settings -description: This article lists the settings that are reverted when you uninstall a provisioning package on Windows 10/11 desktop client devices. +title: Settings changed when you uninstall a provisioning package +description: This article lists the settings that are reverted when you uninstall a provisioning package on Windows desktop client devices. ms.topic: conceptual -ms.date: 12/31/2017 +ms.date: 07/09/2024 --- # Settings changed when you uninstall a provisioning package -When you uninstall a provisioning package, only certain settings are revertible. This article lists the settings that are reverted when you uninstall a provisioning package. - -As an administrator, you can uninstall by using the **Add or remove a package for work or school** option available under **Settings** > **Accounts** > **Access work or school**. +When you uninstall a provisioning package, only certain settings are revertible. This article lists the settings that are reverted when you uninstall a provisioning package. As an administrator, you can uninstall by using the **Add or remove a package for work or school** option available under **Settings** > **Accounts** > **Access work or school**. When a provisioning package is uninstalled, some of its settings are reverted, which means the value for the setting is changed to the next available or default value. Not all settings, however, are revertible. -Only settings in the following lists are revertible. +> [!IMPORTANT] +> Only settings in the following lists are revertible. ## Registry-based settings @@ -21,8 +20,8 @@ The registry-based settings that are revertible when a provisioning package is u - [Wi-Fi Sense](../wcd/wcd-connectivityprofiles.md#wifisense) - [CountryAndRegion](../wcd/wcd-countryandregion.md) -- DeviceManagement / PGList/ LogicalProxyName -- UniversalAppInstall / LaunchAppAtLogin +- [DeviceManagement / PGList / LogicalProxyName](../wcd/wcd-devicemanagement.md#pglist) +- [UniversalAppInstall](../wcd/wcd-universalappinstall.md) / LaunchAppAtLogin - [Power](/previous-versions//dn953704(v=vs.85)) - [TabletMode](../wcd/wcd-tabletmode.md) - [Maps](../wcd/wcd-maps.md) @@ -33,26 +32,26 @@ The registry-based settings that are revertible when a provisioning package is u ## CSP-based settings -Here is the list of revertible settings based on configuration service providers (CSPs). +Here's the list of revertible settings based on configuration service providers (CSPs). -[ActiveSync CSP](/windows/client-management/mdm/activesync-csp) -[AppLocker CSP](/windows/client-management/mdm/applocker-csp) -[BrowserFavorite CSP](/windows/client-management/mdm/browserfavorite-csp) -[CertificateStore CSP](/windows/client-management/mdm/certificatestore-csp) -[ClientCertificateInstall CSP](/windows/client-management/mdm/clientcertificateinstall-csp) -[RootCATrustedCertificates CSP](/windows/client-management/mdm/rootcacertificates-csp) -[CM_CellularEntries CSP](/windows/client-management/mdm/cm-cellularentries-csp) -[CM_ProxyEntries CSP](/windows/client-management/mdm/cm-proxyentries-csp) -[CMPolicy CSP](/windows/client-management/mdm/cmpolicy-csp) -[CMPolicyEnterprise CSP](/windows/client-management/mdm/cmpolicyenterprise-csp) -[EMAIL2 CSP](/windows/client-management/mdm/email2-csp) -[EnterpriseAPN CSP](/windows/client-management/mdm/enterpriseapn-csp) -[EnterpriseDesktopAppManagement CSP](/windows/client-management/mdm/enterprisedesktopappmanagement-csp) -[EnterpriseModernAppManagement CSP](/windows/client-management/mdm/enterprisemodernappmanagement-csp) -[NAP CSP](/windows/client-management/mdm/nap-csp) -[PassportForWork CSP](/windows/client-management/mdm/passportforwork-csp) -[Provisioning CSP](/windows/client-management/mdm/provisioning-csp) -[SecureAssessment CSP](/windows/client-management/mdm/secureassessment-csp) -[VPN CSP](/windows/client-management/mdm/vpn-csp) -[VPNv2 CSP](/windows/client-management/mdm/vpnv2-csp) -[WiFi CSP](/windows/client-management/mdm/wifi-csp) +- [ActiveSync CSP](/windows/client-management/mdm/activesync-csp) +- [AppLocker CSP](/windows/client-management/mdm/applocker-csp) +- [BrowserFavorite CSP](/windows/client-management/mdm/browserfavorite-csp) +- [CertificateStore CSP](/windows/client-management/mdm/certificatestore-csp) +- [ClientCertificateInstall CSP](/windows/client-management/mdm/clientcertificateinstall-csp) +- [RootCATrustedCertificates CSP](/windows/client-management/mdm/rootcacertificates-csp) +- [CM_CellularEntries CSP](/windows/client-management/mdm/cm-cellularentries-csp) +- [CM_ProxyEntries CSP](/windows/client-management/mdm/cm-proxyentries-csp) +- [CMPolicy CSP](/windows/client-management/mdm/cmpolicy-csp) +- [CMPolicyEnterprise CSP](/windows/client-management/mdm/cmpolicyenterprise-csp) +- [EMAIL2 CSP](/windows/client-management/mdm/email2-csp) +- [EnterpriseAPN CSP](/windows/client-management/mdm/enterpriseapn-csp) +- [EnterpriseDesktopAppManagement CSP](/windows/client-management/mdm/enterprisedesktopappmanagement-csp) +- [EnterpriseModernAppManagement CSP](/windows/client-management/mdm/enterprisemodernappmanagement-csp) +- [NAP CSP](/windows/client-management/mdm/nap-csp) +- [PassportForWork CSP](/windows/client-management/mdm/passportforwork-csp) +- [Provisioning CSP](/windows/client-management/mdm/provisioning-csp) +- [SecureAssessment CSP](/windows/client-management/mdm/secureassessment-csp) +- [VPN CSP](/windows/client-management/mdm/vpn-csp) +- [VPNv2 CSP](/windows/client-management/mdm/vpnv2-csp) +- [WiFi CSP](/windows/client-management/mdm/wifi-csp) diff --git a/windows/configuration/provisioning-packages/toc.yml b/windows/configuration/provisioning-packages/toc.yml index afd0f1f158..2e5266898d 100644 --- a/windows/configuration/provisioning-packages/toc.yml +++ b/windows/configuration/provisioning-packages/toc.yml @@ -1,29 +1,35 @@ items: - name: Overview href: provisioning-packages.md - - name: How provisioning works in Windows client + - name: How provisioning works href: provisioning-how-it-works.md - - name: Introduction to configuration service providers (CSPs) - href: how-it-pros-can-use-configuration-service-providers.md - - name: Install Windows Configuration Designer - href: provisioning-install-icd.md - - name: Create a provisioning package - href: provisioning-create-package.md - - name: Apply a provisioning package - href: provisioning-apply-package.md - - name: Settings changed when you uninstall a provisioning package - href: provisioning-uninstall-package.md - - name: Provision PCs with common settings for initial deployment (desktop wizard) - href: provision-pcs-for-initial-deployment.md - - name: Provision PCs with apps - href: provision-pcs-with-apps.md - - name: Use a script to install a desktop app in provisioning packages - href: provisioning-script-to-install-app.md + - name: Quickstarts + items: + - name: Install Windows Configuration Designer + href: provisioning-install-icd.md + - name: Create a provisioning package (desktop wizard) + href: provision-pcs-for-initial-deployment.md + - name: Create a provisioning package (advanced) + href: provisioning-create-package.md + - name: Apply a provisioning package + href: provisioning-apply-package.md + - name: Provision apps + items: + - name: Provision apps + href: provision-pcs-with-apps.md + - name: Use a script to install a desktop app + href: provisioning-script-to-install-app.md - name: Create a provisioning package with multivariant settings href: provisioning-multivariant.md - - name: PowerShell cmdlets for provisioning Windows client (reference) - href: provisioning-powershell.md - name: Diagnose provisioning packages href: diagnose-provisioning-packages.md - - name: Windows Configuration Designer command-line interface (reference) - href: provisioning-command-line.md \ No newline at end of file + - name: Settings changed when you uninstall a provisioning package + href: provisioning-uninstall-package.md + - name: Reference + items: + - name: Introduction to configuration service providers (CSPs) + href: how-it-pros-can-use-configuration-service-providers.md + - name: Windows Configuration Designer command-line interface + href: provisioning-command-line.md + - name: PowerShell cmdlets for provisioning Windows client + href: provisioning-powershell.md \ No newline at end of file From 322076a8b47d41370cede9ef279bfe63fac118df Mon Sep 17 00:00:00 2001 From: "Vinay Pamnani (from Dev Box)" Date: Tue, 9 Jul 2024 13:40:45 -0600 Subject: [PATCH 22/41] Mo-updates --- ...-it-pros-can-use-configuration-service-providers.md | 8 ++++---- .../provisioning-packages/provision-pcs-with-apps.md | 10 ++++------ .../provisioning-packages/provisioning-install-icd.md | 2 +- .../provisioning-script-to-install-app.md | 2 -- 4 files changed, 9 insertions(+), 13 deletions(-) diff --git a/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers.md b/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers.md index 978aa8fc5b..9c82d0c44c 100644 --- a/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers.md +++ b/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers.md @@ -19,11 +19,11 @@ Each CSP provides access to specific settings. For example, the [Wi-Fi CSP](/win CSPs receive configuration policies in the XML-based Synchronization Markup Language (SyncML) format, pushed from an MDM-compliant management server, such as Microsoft Intune. Traditional enterprise management systems, such as Microsoft Configuration Manager, can also target CSPs, by using a client-side Windows Management Instrumentation (WMI)-to-CSP Bridge. -### Synchronization Markup Language (SyncML) +## Synchronization Markup Language (SyncML) The Open Mobile Alliance Device Management (OMA-DM) protocol uses the XML-based SyncML for data exchange between compliant servers and clients. SyncML offers an open standard to use as an alternative to vendor-specific management solutions (such as WMI). The value for enterprises adopting industry standard management protocols is that it allows the management of a broader set of vendor devices using a single platform (such as Microsoft Intune). Device policies, including VPN connection profiles, are delivered to client devices formatted as in SyncML. The target CSP reads this information and applies the necessary configurations. -### The WMI-to-CSP Bridge +## The WMI-to-CSP Bridge The WMI-to-CSP Bridge is a component allowing configuration of Windows client CSPs using scripts and traditional enterprise management software, such as Configuration Manager using WMI. The bridge is responsible for reading WMI commands and through a component called the common device configurator pass them to a CSP for application on the device. @@ -35,7 +35,7 @@ Generally, enterprises rely on Group Policy or MDM to configure and manage devic In addition, you may have unmanaged devices, or a large number of devices that you want to configure before enrolling them in management. You may also want to apply custom settings that aren't available through your MDM service. The [CSP documentation](/windows/client-management/mdm/configuration-service-provider-reference) can help you understand the settings that can be configured or queried. You can also learn about all of the available configuration settings. -### CSPs in Windows Configuration Designer +## CSPs in Windows Configuration Designer You can use Windows Configuration Designer to create [provisioning packages](provisioning-packages.md) to apply settings to devices during the out-of-box-experience (OOBE), and after the devices are set up. You can also use provisioning packages to configure a device's connectivity and enroll the device in MDM. Many of the runtime settings in Windows Configuration Designer are based on CSPs. @@ -45,7 +45,7 @@ Many settings in Windows Configuration Designer display documentation for that s [Provisioning packages in Windows client](provisioning-packages.md) explains how to use the Windows Configuration Designer tool to create a runtime provisioning package. -### CSPs in MDM +## CSPs in MDM Most, if not all, CSPs are surfaced through your MDM service. If you see a CSP that provides a capability that you want to make use of and can't find that capability in your MDM service, contact your MDM provider for assistance. It might be named differently than you expected. You can see the CSPs supported by MDM in the [Configuration service provider reference](/windows/client-management/mdm/configuration-service-provider-reference). diff --git a/windows/configuration/provisioning-packages/provision-pcs-with-apps.md b/windows/configuration/provisioning-packages/provision-pcs-with-apps.md index 2052ee0f96..3ffeaa9b73 100644 --- a/windows/configuration/provisioning-packages/provision-pcs-with-apps.md +++ b/windows/configuration/provisioning-packages/provision-pcs-with-apps.md @@ -27,7 +27,7 @@ When you add an app in a Windows Configuration Designer wizard, the appropriate - **Command line arguments**: Optionally, append more command arguments. The silent flag is appended for you. Example: PROPERTY=VALUE - **Continue installations after failure**: Optionally, specify if you want to continue installing more apps if this app fails to install - **Restart required**: Optionally, specify if you want to reboot after a successful install of this app -- **Required win32 app dependencies**: Optionally, specify more files that are required for the installation of the app. For installers that have multiple file dependencies or have directory structures, [create a cab file of the assets](provisioning-script-to-install-app.md#cab-the-application-assets). The installation script should [include expansion of the .cab file](provisioning-script-to-install-app.md#cab-extract). +- **Required win32 app dependencies**: Optionally, specify more files that are required for the installation of the app. For installers that have multiple file dependencies or have directory structures, [create a cab file of the assets](provisioning-script-to-install-app.md#cab-the-application-assets). The installation script should [include expansion of the .cab file](provisioning-script-to-install-app.md#extract-from-a-cab-example). > [!NOTE] > You can find more information about command-line options for Msiexec.exe [here](/windows/win32/msi/command-line-options). @@ -38,7 +38,7 @@ When you add an app in a Windows Configuration Designer wizard, the appropriate - **Return Codes**: Specify the return codes for success and success with restart (0 and 3010 by default respectively) Any return code that isn't listed is interpreted as failure. The text boxes are space delimited. - **Continue installations after failure**: Optionally, specify if you want to continue installing more apps if this app fails to install - **Restart required**: Optionally, specify if you want to reboot after a successful install of this app -- **Required win32 app dependencies**: Optionally, specify more files that are required for the installation of the app. For installers that have multiple file dependencies or have directory structures, [create a cab file of the assets](provisioning-script-to-install-app.md#cab-the-application-assets). The installation script should [include expansion of the .cab file](provisioning-script-to-install-app.md#cab-extract). +- **Required win32 app dependencies**: Optionally, specify more files that are required for the installation of the app. For installers that have multiple file dependencies or have directory structures, [create a cab file of the assets](provisioning-script-to-install-app.md#cab-the-application-assets). The installation script should [include expansion of the .cab file](provisioning-script-to-install-app.md#extract-from-a-cab-example). ## Add a Windows desktop application using advanced editor @@ -109,13 +109,11 @@ For details about the settings you can customize in provisioning packages, see [ > [!TIP] > We recommend that you include a trusted provisioning certificate in your provisioning package. When the package is applied to a device, the certificate is added to the system store. Any package signed with that certificate can be applied silently. -1. Select **Next** to specify the output location where you want the provisioning package to go once it's built. By default, Windows ICD uses the project folder as the output location.

- Optionally, you can select **Browse** to change the default output location. +1. Select **Next** to specify the output location where you want the provisioning package to go once it's built. By default, Windows ICD uses the project folder as the output location. Optionally, you can select **Browse** to change the default output location. 1. Select **Next**. -1. Select **Build** to start building the package. The project information is displayed in the build page and the progress bar indicates the build status.

- If you need to cancel the build, select **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations Page**. +1. Select **Build** to start building the package. The project information is displayed in the build page and the progress bar indicates the build status. If you need to cancel the build, select **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations Page**. 1. If your build fails, an error message shows up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again. If your build is successful, the name of the provisioning package, output directory, and project directory is shown. diff --git a/windows/configuration/provisioning-packages/provisioning-install-icd.md b/windows/configuration/provisioning-packages/provisioning-install-icd.md index 8acca19051..3b4fddb9b4 100644 --- a/windows/configuration/provisioning-packages/provisioning-install-icd.md +++ b/windows/configuration/provisioning-packages/provisioning-install-icd.md @@ -65,5 +65,5 @@ Windows Configuration Designer can create provisioning packages for Windows clie > [!div class="nextstepaction"] > Learn more about creating a provisioning package: > -> [Create a provisioning package (simple)](provision-pcs-for-initial-deployment.md) +> [Create a provisioning package (desktop wizard)](provision-pcs-for-initial-deployment.md) > [Create a provisioning package (advanced)](provisioning-create-package.md) diff --git a/windows/configuration/provisioning-packages/provisioning-script-to-install-app.md b/windows/configuration/provisioning-packages/provisioning-script-to-install-app.md index 05fc65f6c1..970ed67763 100644 --- a/windows/configuration/provisioning-packages/provisioning-script-to-install-app.md +++ b/windows/configuration/provisioning-packages/provisioning-script-to-install-app.md @@ -105,8 +105,6 @@ PsExec.exe -accepteula -i -s cmd.exe /c 'powershell.exe my_powershell_script.ps1 echo result: %ERRORLEVEL% >> %LOGFILE% ``` - - ### Extract from a .CAB example This example script shows expansion of a .cab from the provisioning commands script, and installation of the expanded setup.exe From dd653a9b5080d983ff887c5902c7fc647a60d7ad Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 10 Jul 2024 10:20:51 -0700 Subject: [PATCH 23/41] add context file --- windows/deployment/context/context.yml | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 windows/deployment/context/context.yml diff --git a/windows/deployment/context/context.yml b/windows/deployment/context/context.yml new file mode 100644 index 0000000000..aa53a529eb --- /dev/null +++ b/windows/deployment/context/context.yml @@ -0,0 +1,4 @@ +### YamlMime: ContextObject +brand: windows +breadcrumb_path: ../breadcrumb/toc.yml +toc_rel: ../toc.yml \ No newline at end of file From 89b9257a02f6eab8f00d1d5f093dd6708a912a0e Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 10 Jul 2024 10:25:32 -0700 Subject: [PATCH 24/41] use context file --- windows/deployment/TOC.yml | 36 ++++++++++++++++++------------------ 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/windows/deployment/TOC.yml b/windows/deployment/TOC.yml index ce71f48060..88851f15ff 100644 --- a/windows/deployment/TOC.yml +++ b/windows/deployment/TOC.yml @@ -29,7 +29,7 @@ - name: Plan items: - name: Plan for Windows 11 - href: /windows/whats-new/windows-11-plan?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json + href: /windows/whats-new/windows-11-plan?context=/windows/deployment/context/context - name: Create a deployment plan href: update/create-deployment-plan.md - name: Define readiness criteria @@ -41,12 +41,12 @@ - name: Define your servicing strategy href: update/plan-define-strategy.md - name: Delivery Optimization for Windows client updates - href: do/waas-delivery-optimization.md?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json + href: do/waas-delivery-optimization.md?context=/windows/deployment/context/context items: - name: Using a proxy with Delivery Optimization - href: do/delivery-optimization-proxy.md?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json + href: do/delivery-optimization-proxy.md?context=/windows/deployment/context/context - name: Delivery Optimization client-service communication - href: do/delivery-optimization-workflow.md?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json + href: do/delivery-optimization-workflow.md?context=/windows/deployment/context/context - name: Windows 10 deployment considerations href: planning/windows-10-deployment-considerations.md - name: Windows 10 infrastructure requirements @@ -56,17 +56,17 @@ - name: Features removed or planned for replacement items: - name: Windows client features lifecycle - href: /windows/whats-new/feature-lifecycle?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json + href: /windows/whats-new/feature-lifecycle?context=/windows/deployment/context/context - name: Deprecated features - href: /windows/whats-new/deprecated-features?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json + href: /windows/whats-new/deprecated-features?context=/windows/deployment/context/context - name: Resources for deprecated features - href: /windows/whats-new/deprecated-features-resources?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json + href: /windows/whats-new/deprecated-features-resources?context=/windows/deployment/context/context - name: Removed features - href: /windows/whats-new/removed-features?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json + href: /windows/whats-new/removed-features?context=/windows/deployment/context/context - name: Prepare items: - name: Prepare for Windows 11 - href: /windows/whats-new/windows-11-prepare?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json + href: /windows/whats-new/windows-11-prepare?context=/windows/deployment/context/context - name: Prepare to deploy Windows client updates href: update/prepare-deploy-windows.md - name: Evaluate and update infrastructure @@ -74,7 +74,7 @@ - name: Update Baseline href: update/update-baseline.md - name: Set up Delivery Optimization for Windows client updates - href: do/waas-delivery-optimization-setup.md?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json + href: do/waas-delivery-optimization-setup.md?context=/windows/deployment/context/context - name: Configure BranchCache for Windows client updates href: update/waas-branchcache.md - name: Prepare for deployment with Configuration Manager @@ -324,25 +324,25 @@ - name: Resolve Windows upgrade errors href: upgrade/resolve-windows-upgrade-errors.md - name: Quick fixes - href: /troubleshoot/windows-client/deployment/windows-10-upgrade-quick-fixes?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json + href: /troubleshoot/windows-client/deployment/windows-10-upgrade-quick-fixes?context=/windows/deployment/context/context - name: SetupDiag href: upgrade/setupdiag.md - name: Troubleshooting upgrade errors - href: /troubleshoot/windows-client/deployment/windows-10-upgrade-issues-troubleshooting?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json + href: /troubleshoot/windows-client/deployment/windows-10-upgrade-issues-troubleshooting?context=/windows/deployment/context/context - name: Windows error reporting href: upgrade/windows-error-reporting.md - name: Upgrade error codes - href: /troubleshoot/windows-client/deployment/windows-10-upgrade-error-codes?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json + href: /troubleshoot/windows-client/deployment/windows-10-upgrade-error-codes?context=/windows/deployment/context/context - name: Log files href: upgrade/log-files.md - name: Resolution procedures - href: /troubleshoot/windows-client/deployment/windows-10-upgrade-resolution-procedures?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json + href: /troubleshoot/windows-client/deployment/windows-10-upgrade-resolution-procedures?context=/windows/deployment/context/context - name: Submit Windows client upgrade errors href: upgrade/submit-errors.md - name: Troubleshoot Windows Update items: - name: How to troubleshoot Windows Update - href: /troubleshoot/windows-client/deployment/windows-update-issues-troubleshooting?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json + href: /troubleshoot/windows-client/deployment/windows-update-issues-troubleshooting?context=/windows/deployment/context/context - name: Opt out of safeguard holds href: update/safeguard-opt-out.md - name: Determine the source of Windows Updates @@ -350,7 +350,7 @@ - name: Windows Update security href: ./update/windows-update-security.md - name: Common Windows Update errors - href: /troubleshoot/windows-client/deployment/common-windows-update-errors?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json + href: /troubleshoot/windows-client/deployment/common-windows-update-errors?context=/windows/deployment/context/context - name: Windows Update error code reference href: update/windows-update-error-reference.md - name: Troubleshoot the Windows Update for Business deployment service @@ -371,13 +371,13 @@ - name: Servicing stack updates href: update/servicing-stack-updates.md - name: Update CSP policies - href: /windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json + href: /windows/client-management/mdm/policy-csp-update?context=/windows/deployment/context/context - name: Additional Windows Update settings href: update/waas-wu-settings.md - name: Update other Microsoft products href: update/update-other-microsoft-products.md - name: Delivery Optimization reference - href: do/waas-delivery-optimization-reference.md?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json + href: do/waas-delivery-optimization-reference.md?context=/windows/deployment/context/context - name: FoD and language packs for WSUS and Configuration Manager href: update/fod-and-lang-packs.md - name: Windows client in S mode From e1d84479c71dffb64b33d4e48664fdd4fd76106c Mon Sep 17 00:00:00 2001 From: tiaraquan Date: Wed, 10 Jul 2024 10:25:46 -0700 Subject: [PATCH 25/41] SFI- Global admin review --- .../deploy/windows-autopatch-register-devices.md | 7 ++----- .../windows-autopatch-policy-health-and-remediation.md | 4 ++-- ...-windows-quality-and-feature-update-reports-overview.md | 3 +-- 3 files changed, 5 insertions(+), 9 deletions(-) diff --git a/windows/deployment/windows-autopatch/deploy/windows-autopatch-register-devices.md b/windows/deployment/windows-autopatch/deploy/windows-autopatch-register-devices.md index f0938f7fd7..5836f3979a 100644 --- a/windows/deployment/windows-autopatch/deploy/windows-autopatch-register-devices.md +++ b/windows/deployment/windows-autopatch/deploy/windows-autopatch-register-devices.md @@ -1,7 +1,7 @@ --- title: Register your devices description: This article details how to register devices in Autopatch. -ms.date: 02/15/2024 +ms.date: 07/10/2024 ms.service: windows-client ms.subservice: itpro-updates ms.topic: how-to @@ -112,10 +112,7 @@ The following are the possible device readiness statuses in Windows Autopatch: ## Built-in roles required for device registration -A role defines the set of permissions granted to users assigned to that role. You can use one of the following built-in roles in Windows Autopatch to register devices: - -- Microsoft Entra Global Administrator -- Intune Service Administrator +A role defines the set of permissions granted to users assigned to that role. You can use the **Intune Service Administrator** role to register devices. For more information, see [Microsoft Entra built-in roles](/azure/active-directory/roles/permissions-reference) and [Role-based access control (RBAC) with Microsoft Intune](/mem/intune/fundamentals/role-based-access-control). diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-policy-health-and-remediation.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-policy-health-and-remediation.md index d0371e0e59..54d541524e 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-policy-health-and-remediation.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-policy-health-and-remediation.md @@ -1,7 +1,7 @@ --- title: policy health and remediation description: Describes what Autopatch does it detects policies in the tenant are either missing or modified to states that affect the service -ms.date: 07/08/2024 +ms.date: 07/10/2024 ms.service: windows-client ms.subservice: itpro-updates ms.topic: how-to @@ -44,7 +44,7 @@ Alerts are raised when deployment rings don't have the required policies and the ## Built-in roles required for remediation actions -The minimum role required to restore configurations is **Intune Service Administrator**. You can also perform these actions in the Global administrator role. +The minimum role required to restore configurations is **Intune Service Administrator**. ## Restore device configuration policy diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-and-feature-update-reports-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-and-feature-update-reports-overview.md index 9d5cd07373..c556fca641 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-and-feature-update-reports-overview.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-and-feature-update-reports-overview.md @@ -1,7 +1,7 @@ --- title: Windows quality and feature update reports overview description: This article details the types of reports available and info about update device eligibility, device update health, device update trends in Windows Autopatch. -ms.date: 04/09/2024 +ms.date: 07/10/2024 ms.service: windows-client ms.subservice: itpro-updates ms.topic: conceptual @@ -53,7 +53,6 @@ The Windows feature update report types are organized into the following focus a Users with the following permissions can access the reports: -- Global Administrator - Intune Service Administrator - Global Reader - Services Support Administrator From a06aa38440b7d44374a50332716b46d76a17e491 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 10 Jul 2024 11:32:47 -0700 Subject: [PATCH 26/41] Revert "use context file for deployment folder" --- windows/deployment/TOC.yml | 36 ++++++++++++++++++------------------ 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/windows/deployment/TOC.yml b/windows/deployment/TOC.yml index 88851f15ff..ce71f48060 100644 --- a/windows/deployment/TOC.yml +++ b/windows/deployment/TOC.yml @@ -29,7 +29,7 @@ - name: Plan items: - name: Plan for Windows 11 - href: /windows/whats-new/windows-11-plan?context=/windows/deployment/context/context + href: /windows/whats-new/windows-11-plan?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json - name: Create a deployment plan href: update/create-deployment-plan.md - name: Define readiness criteria @@ -41,12 +41,12 @@ - name: Define your servicing strategy href: update/plan-define-strategy.md - name: Delivery Optimization for Windows client updates - href: do/waas-delivery-optimization.md?context=/windows/deployment/context/context + href: do/waas-delivery-optimization.md?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json items: - name: Using a proxy with Delivery Optimization - href: do/delivery-optimization-proxy.md?context=/windows/deployment/context/context + href: do/delivery-optimization-proxy.md?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json - name: Delivery Optimization client-service communication - href: do/delivery-optimization-workflow.md?context=/windows/deployment/context/context + href: do/delivery-optimization-workflow.md?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json - name: Windows 10 deployment considerations href: planning/windows-10-deployment-considerations.md - name: Windows 10 infrastructure requirements @@ -56,17 +56,17 @@ - name: Features removed or planned for replacement items: - name: Windows client features lifecycle - href: /windows/whats-new/feature-lifecycle?context=/windows/deployment/context/context + href: /windows/whats-new/feature-lifecycle?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json - name: Deprecated features - href: /windows/whats-new/deprecated-features?context=/windows/deployment/context/context + href: /windows/whats-new/deprecated-features?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json - name: Resources for deprecated features - href: /windows/whats-new/deprecated-features-resources?context=/windows/deployment/context/context + href: /windows/whats-new/deprecated-features-resources?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json - name: Removed features - href: /windows/whats-new/removed-features?context=/windows/deployment/context/context + href: /windows/whats-new/removed-features?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json - name: Prepare items: - name: Prepare for Windows 11 - href: /windows/whats-new/windows-11-prepare?context=/windows/deployment/context/context + href: /windows/whats-new/windows-11-prepare?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json - name: Prepare to deploy Windows client updates href: update/prepare-deploy-windows.md - name: Evaluate and update infrastructure @@ -74,7 +74,7 @@ - name: Update Baseline href: update/update-baseline.md - name: Set up Delivery Optimization for Windows client updates - href: do/waas-delivery-optimization-setup.md?context=/windows/deployment/context/context + href: do/waas-delivery-optimization-setup.md?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json - name: Configure BranchCache for Windows client updates href: update/waas-branchcache.md - name: Prepare for deployment with Configuration Manager @@ -324,25 +324,25 @@ - name: Resolve Windows upgrade errors href: upgrade/resolve-windows-upgrade-errors.md - name: Quick fixes - href: /troubleshoot/windows-client/deployment/windows-10-upgrade-quick-fixes?context=/windows/deployment/context/context + href: /troubleshoot/windows-client/deployment/windows-10-upgrade-quick-fixes?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json - name: SetupDiag href: upgrade/setupdiag.md - name: Troubleshooting upgrade errors - href: /troubleshoot/windows-client/deployment/windows-10-upgrade-issues-troubleshooting?context=/windows/deployment/context/context + href: /troubleshoot/windows-client/deployment/windows-10-upgrade-issues-troubleshooting?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json - name: Windows error reporting href: upgrade/windows-error-reporting.md - name: Upgrade error codes - href: /troubleshoot/windows-client/deployment/windows-10-upgrade-error-codes?context=/windows/deployment/context/context + href: /troubleshoot/windows-client/deployment/windows-10-upgrade-error-codes?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json - name: Log files href: upgrade/log-files.md - name: Resolution procedures - href: /troubleshoot/windows-client/deployment/windows-10-upgrade-resolution-procedures?context=/windows/deployment/context/context + href: /troubleshoot/windows-client/deployment/windows-10-upgrade-resolution-procedures?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json - name: Submit Windows client upgrade errors href: upgrade/submit-errors.md - name: Troubleshoot Windows Update items: - name: How to troubleshoot Windows Update - href: /troubleshoot/windows-client/deployment/windows-update-issues-troubleshooting?context=/windows/deployment/context/context + href: /troubleshoot/windows-client/deployment/windows-update-issues-troubleshooting?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json - name: Opt out of safeguard holds href: update/safeguard-opt-out.md - name: Determine the source of Windows Updates @@ -350,7 +350,7 @@ - name: Windows Update security href: ./update/windows-update-security.md - name: Common Windows Update errors - href: /troubleshoot/windows-client/deployment/common-windows-update-errors?context=/windows/deployment/context/context + href: /troubleshoot/windows-client/deployment/common-windows-update-errors?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json - name: Windows Update error code reference href: update/windows-update-error-reference.md - name: Troubleshoot the Windows Update for Business deployment service @@ -371,13 +371,13 @@ - name: Servicing stack updates href: update/servicing-stack-updates.md - name: Update CSP policies - href: /windows/client-management/mdm/policy-csp-update?context=/windows/deployment/context/context + href: /windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json - name: Additional Windows Update settings href: update/waas-wu-settings.md - name: Update other Microsoft products href: update/update-other-microsoft-products.md - name: Delivery Optimization reference - href: do/waas-delivery-optimization-reference.md?context=/windows/deployment/context/context + href: do/waas-delivery-optimization-reference.md?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json - name: FoD and language packs for WSUS and Configuration Manager href: update/fod-and-lang-packs.md - name: Windows client in S mode From 966cb02232a8066b232b092a6d17289f5ba7de4c Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 10 Jul 2024 11:46:30 -0700 Subject: [PATCH 27/41] replacement for context toc 10014 --- windows/deployment/TOC.yml | 36 ++++++++++++++++++------------------ 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/windows/deployment/TOC.yml b/windows/deployment/TOC.yml index ce71f48060..88851f15ff 100644 --- a/windows/deployment/TOC.yml +++ b/windows/deployment/TOC.yml @@ -29,7 +29,7 @@ - name: Plan items: - name: Plan for Windows 11 - href: /windows/whats-new/windows-11-plan?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json + href: /windows/whats-new/windows-11-plan?context=/windows/deployment/context/context - name: Create a deployment plan href: update/create-deployment-plan.md - name: Define readiness criteria @@ -41,12 +41,12 @@ - name: Define your servicing strategy href: update/plan-define-strategy.md - name: Delivery Optimization for Windows client updates - href: do/waas-delivery-optimization.md?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json + href: do/waas-delivery-optimization.md?context=/windows/deployment/context/context items: - name: Using a proxy with Delivery Optimization - href: do/delivery-optimization-proxy.md?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json + href: do/delivery-optimization-proxy.md?context=/windows/deployment/context/context - name: Delivery Optimization client-service communication - href: do/delivery-optimization-workflow.md?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json + href: do/delivery-optimization-workflow.md?context=/windows/deployment/context/context - name: Windows 10 deployment considerations href: planning/windows-10-deployment-considerations.md - name: Windows 10 infrastructure requirements @@ -56,17 +56,17 @@ - name: Features removed or planned for replacement items: - name: Windows client features lifecycle - href: /windows/whats-new/feature-lifecycle?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json + href: /windows/whats-new/feature-lifecycle?context=/windows/deployment/context/context - name: Deprecated features - href: /windows/whats-new/deprecated-features?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json + href: /windows/whats-new/deprecated-features?context=/windows/deployment/context/context - name: Resources for deprecated features - href: /windows/whats-new/deprecated-features-resources?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json + href: /windows/whats-new/deprecated-features-resources?context=/windows/deployment/context/context - name: Removed features - href: /windows/whats-new/removed-features?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json + href: /windows/whats-new/removed-features?context=/windows/deployment/context/context - name: Prepare items: - name: Prepare for Windows 11 - href: /windows/whats-new/windows-11-prepare?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json + href: /windows/whats-new/windows-11-prepare?context=/windows/deployment/context/context - name: Prepare to deploy Windows client updates href: update/prepare-deploy-windows.md - name: Evaluate and update infrastructure @@ -74,7 +74,7 @@ - name: Update Baseline href: update/update-baseline.md - name: Set up Delivery Optimization for Windows client updates - href: do/waas-delivery-optimization-setup.md?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json + href: do/waas-delivery-optimization-setup.md?context=/windows/deployment/context/context - name: Configure BranchCache for Windows client updates href: update/waas-branchcache.md - name: Prepare for deployment with Configuration Manager @@ -324,25 +324,25 @@ - name: Resolve Windows upgrade errors href: upgrade/resolve-windows-upgrade-errors.md - name: Quick fixes - href: /troubleshoot/windows-client/deployment/windows-10-upgrade-quick-fixes?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json + href: /troubleshoot/windows-client/deployment/windows-10-upgrade-quick-fixes?context=/windows/deployment/context/context - name: SetupDiag href: upgrade/setupdiag.md - name: Troubleshooting upgrade errors - href: /troubleshoot/windows-client/deployment/windows-10-upgrade-issues-troubleshooting?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json + href: /troubleshoot/windows-client/deployment/windows-10-upgrade-issues-troubleshooting?context=/windows/deployment/context/context - name: Windows error reporting href: upgrade/windows-error-reporting.md - name: Upgrade error codes - href: /troubleshoot/windows-client/deployment/windows-10-upgrade-error-codes?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json + href: /troubleshoot/windows-client/deployment/windows-10-upgrade-error-codes?context=/windows/deployment/context/context - name: Log files href: upgrade/log-files.md - name: Resolution procedures - href: /troubleshoot/windows-client/deployment/windows-10-upgrade-resolution-procedures?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json + href: /troubleshoot/windows-client/deployment/windows-10-upgrade-resolution-procedures?context=/windows/deployment/context/context - name: Submit Windows client upgrade errors href: upgrade/submit-errors.md - name: Troubleshoot Windows Update items: - name: How to troubleshoot Windows Update - href: /troubleshoot/windows-client/deployment/windows-update-issues-troubleshooting?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json + href: /troubleshoot/windows-client/deployment/windows-update-issues-troubleshooting?context=/windows/deployment/context/context - name: Opt out of safeguard holds href: update/safeguard-opt-out.md - name: Determine the source of Windows Updates @@ -350,7 +350,7 @@ - name: Windows Update security href: ./update/windows-update-security.md - name: Common Windows Update errors - href: /troubleshoot/windows-client/deployment/common-windows-update-errors?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json + href: /troubleshoot/windows-client/deployment/common-windows-update-errors?context=/windows/deployment/context/context - name: Windows Update error code reference href: update/windows-update-error-reference.md - name: Troubleshoot the Windows Update for Business deployment service @@ -371,13 +371,13 @@ - name: Servicing stack updates href: update/servicing-stack-updates.md - name: Update CSP policies - href: /windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json + href: /windows/client-management/mdm/policy-csp-update?context=/windows/deployment/context/context - name: Additional Windows Update settings href: update/waas-wu-settings.md - name: Update other Microsoft products href: update/update-other-microsoft-products.md - name: Delivery Optimization reference - href: do/waas-delivery-optimization-reference.md?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json + href: do/waas-delivery-optimization-reference.md?context=/windows/deployment/context/context - name: FoD and language packs for WSUS and Configuration Manager href: update/fod-and-lang-packs.md - name: Windows client in S mode From 939e43cf5456d11eb587cd16ee1cffecfe0b998a Mon Sep 17 00:00:00 2001 From: "Vinay Pamnani (from Dev Box)" Date: Wed, 10 Jul 2024 15:29:16 -0600 Subject: [PATCH 28/41] Hardware security freshness --- ...tion-based-protection-of-code-integrity.md | 2 +- ...sed-root-of-trust-helps-protect-windows.md | 12 ++-- windows/security/hardware-security/index.md | 2 +- .../kernel-dma-protection-for-thunderbolt.md | 17 +++-- .../microsoft-pluton-security-processor.md | 4 +- .../hardware-security/pluton/pluton-as-tpm.md | 6 +- ...-guard-secure-launch-and-smm-protection.md | 28 +++----- ...ackup-tpm-recovery-information-to-ad-ds.md | 2 +- .../tpm/change-the-tpm-owner-password.md | 9 +-- .../tpm/how-windows-uses-the-tpm.md | 44 ++++++------ ...lize-and-configure-ownership-of-the-tpm.md | 33 ++++----- .../tpm/manage-tpm-commands.md | 16 +---- .../tpm/manage-tpm-lockout.md | 10 +-- .../switch-pcr-banks-on-tpm-2-0-devices.md | 12 ++-- .../hardware-security/tpm/tpm-fundamentals.md | 4 +- .../tpm/tpm-recommendations.md | 34 ++++----- .../tpm/trusted-platform-module-overview.md | 2 +- ...m-module-services-group-policy-settings.md | 72 ++++++++++++++----- 18 files changed, 155 insertions(+), 154 deletions(-) diff --git a/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity.md b/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity.md index 1ef34f786a..a5cd24d3c9 100644 --- a/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity.md +++ b/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity.md @@ -2,7 +2,7 @@ title: Enable memory integrity description: This article explains the steps to opt in to using memory integrity on Windows devices. ms.topic: conceptual -ms.date: 03/26/2024 +ms.date: 07/10/2024 appliesto: - "βœ… Windows 11" - "βœ… Windows 10" diff --git a/windows/security/hardware-security/how-hardware-based-root-of-trust-helps-protect-windows.md b/windows/security/hardware-security/how-hardware-based-root-of-trust-helps-protect-windows.md index e68ce7f0d5..54f9cc0237 100644 --- a/windows/security/hardware-security/how-hardware-based-root-of-trust-helps-protect-windows.md +++ b/windows/security/hardware-security/how-hardware-based-root-of-trust-helps-protect-windows.md @@ -2,7 +2,7 @@ title: How System Guard helps protect Windows description: Learn how System Guard reorganizes the existing Windows system integrity features under one roof. ms.localizationpriority: medium -ms.date: 01/16/2024 +ms.date: 07/10/2024 ms.topic: conceptual --- @@ -33,7 +33,7 @@ Also, a bug fix for UEFI code can take a long time to design, build, retest, val ### Secure Launchβ€”the Dynamic Root of Trust for Measurement (DRTM) -[System Guard Secure Launch](system-guard-secure-launch-and-smm-protection.md), first introduced in Windows 10 version 1809, aims to alleviate these issues by leveraging a technology known as the Dynamic Root of Trust for Measurement (DRTM). DRTM lets the system freely boot into untrusted code initially, but shortly after launches the system into a trusted state by taking control of all CPUs and forcing them down a well-known and measured code path. This has the benefit of allowing untrusted early UEFI code to boot the system, but then being able to securely transition into a trusted and measured state. +[System Guard Secure Launch](system-guard-secure-launch-and-smm-protection.md), first introduced in Windows 10 version 1809, aims to alleviate these issues by using a technology known as the Dynamic Root of Trust for Measurement (DRTM). DRTM lets the system freely boot into untrusted code initially, but shortly after launches the system into a trusted state by taking control of all CPUs and forcing them down a well-known and measured code path. This has the benefit of allowing untrusted early UEFI code to boot the system, but then being able to securely transition into a trusted and measured state. ![System Guard Secure Launch.](images/system-guard-secure-launch.png) @@ -41,7 +41,7 @@ Secure Launch simplifies management of SRTM measurements because the launch code ### System Management Mode (SMM) protection -System Management Mode (SMM) is a special-purpose CPU mode in x86 microcontrollers that handles power management, hardware configuration, thermal monitoring, and anything else the manufacturer deems useful. Whenever one of these system operations is requested, a non-maskable interrupt (SMI) is invoked at runtime, which executes SMM code installed by the BIOS. SMM code executes in the highest privilege level and is invisible to the OS, which makes it an attractive target for malicious activity. Even if System Guard Secure Launch is used to late launch, SMM code can potentially access hypervisor memory and change the hypervisor. +System Management Mode (SMM) is a special-purpose CPU mode in x86 microcontrollers that handles power management, hardware configuration, thermal monitoring, and anything else the manufacturer deems useful. Whenever one of these system operations is requested, a nonmaskable interrupt (SMI) is invoked at runtime, which executes SMM code installed by the BIOS. SMM code executes in the highest privilege level and is invisible to the OS, which makes it an attractive target for malicious activity. Even if System Guard Secure Launch is used to late launch, SMM code can potentially access hypervisor memory and change the hypervisor. To defend against this, two techniques are used: @@ -88,7 +88,7 @@ This feature is available for the following processors: |AUX Policy|The required AUX policy must be as follows:

  • A = TPM2_PolicyLocality (Locality 3 & Locality 4)
  • B = TPM2_PolicyCommandCode (TPM_CC_NV_UndefineSpecial)
  • authPolicy = \{A} OR {{A} AND \{B}}
  • authPolicy digest = 0xef, 0x9a, 0x26, 0xfc, 0x22, 0xd1, 0xae, 0x8c, 0xec, 0xff, 0x59, 0xe9, 0x48, 0x1a, 0xc1, 0xec, 0x53, 0x3d, 0xbe, 0x22, 0x8b, 0xec, 0x6d, 0x17, 0x93, 0x0f, 0x4c, 0xb2, 0xcc, 0x5b, 0x97, 0x24
| |TPM NV Index|Platform firmware must set up a TPM NV index for use by the OS with:
  • Handle: 0x01C101C0
  • Attributes:
    • TPMA_NV_POLICYWRITE
    • TPMA_NV_PPREAD
    • TPMA_NV_OWNERREAD
    • TPMA_NV_AUTHREAD
    • TPMA_NV_POLICYREAD
    • TPMA_NV_NO_DA
    • TPMA_NV_PLATFORMCREATE
    • TPMA_NV_POLICY_DELETE
  • A policy of:
    • A = TPM2_PolicyAuthorize(MSFT_DRTM_AUTH_BLOB_SigningKey)
    • B = TPM2_PolicyCommandCode(TPM_CC_NV_UndefineSpaceSpecial)
    • authPolicy = \{A} OR {{A} AND \{B}}
    • Digest value of 0xcb, 0x45, 0xc8, 0x1f, 0xf3, 0x4b, 0xcf, 0x0a, 0xfb, 0x9e, 0x1a, 0x80, 0x29, 0xfa, 0x23, 0x1c, 0x87, 0x27, 0x30, 0x3c, 0x09, 0x22, 0xdc, 0xce, 0x68, 0x4b, 0xe3, 0xdb, 0x81, 0x7c, 0x20, 0xe1
| |Platform firmware|Platform firmware must carry all code required to execute an Intel® Trusted Execution Technology secure launch:
  • Intel® SINIT ACM must be carried in the OEM BIOS
  • Platforms must ship with a production ACM signed by the correct production Intel® ACM signer for the platform
| -|Platform firmware update|System firmware is recommended to be updated via UpdateCapsule in Windows Update. | +|Platform firmware update|It's recommended to update System firmware via UpdateCapsule in Windows Update. | ### Requirements for AMD® processors starting with Zen2 or later silicon @@ -102,7 +102,7 @@ This feature is available for the following processors: |Modern/Connected Standby|Platforms must support Modern/Connected Standby.| |TPM NV Index|Platform firmware must set up a TPM NV index for use by the OS with:
  • Handle: 0x01C101C0
  • Attributes:
    • TPMA_NV_POLICYWRITE
    • TPMA_NV_PPREAD
    • TPMA_NV_OWNERREAD
    • TPMA_NV_AUTHREAD
    • TPMA_NV_POLICYREAD
    • TPMA_NV_NO_DA
    • TPMA_NV_PLATFORMCREATE
    • TPMA_NV_POLICY_DELETE
  • A policy of:
    • A = TPM2_PolicyAuthorize(MSFT_DRTM_AUTH_BLOB_SigningKey)
    • B = TPM2_PolicyCommandCode(TPM_CC_NV_UndefineSpaceSpecial)
    • authPolicy = \{A} OR {{A} AND \{B}}
    • Digest value of 0xcb, 0x45, 0xc8, 0x1f, 0xf3, 0x4b, 0xcf, 0x0a, 0xfb, 0x9e, 0x1a, 0x80, 0x29, 0xfa, 0x23, 0x1c, 0x87, 0x27, 0x30, 0x3c, 0x09, 0x22, 0xdc, 0xce, 0x68, 0x4b, 0xe3, 0xdb, 0x81, 0x7c, 0x20, 0xe1
| |Platform firmware|Platform firmware must carry all code required to execute Secure Launch:
  • AMD® Secure Launch platforms must ship with AMD® DRTM driver devnode exposed and the AMD® DRTM driver installed

Platform must have AMD® Secure Processor Firmware Anti-Rollback protection enabled
Platform must have AMD® Memory Guard enabled.| -|Platform firmware update|System firmware is recommended to be updated via UpdateCapsule in Windows Update. | +|Platform firmware update|It's recommended to update System firmware via UpdateCapsule in Windows Update. | ### Requirements for Qualcomm® processors with SD850 or later chipsets @@ -112,4 +112,4 @@ This feature is available for the following processors: |Monitor Mode Page Tables|All Monitor Mode page tables must:
  • NOT contain any mappings to EfiConventionalMemory (for example no OS/VMM owned memory)
  • They must NOT have execute and write permissions for the same page
  • Platforms must only allow Monitor Mode pages marked as executable
  • The memory map must report Monitor Mode as EfiReservedMemoryType
  • Platforms must provide mechanism to protect the Monitor Mode page tables from modification
| |Modern/Connected Standby|Platforms must support Modern/Connected Standby.| |Platform firmware|Platform firmware must carry all code required to launch.| -|Platform firmware update|System firmware is recommended to be updated via UpdateCapsule in Windows Update. | +|Platform firmware update|It's recommended to update System firmware via UpdateCapsule in Windows Update. | diff --git a/windows/security/hardware-security/index.md b/windows/security/hardware-security/index.md index dbe8b6153f..e8cfb27d50 100644 --- a/windows/security/hardware-security/index.md +++ b/windows/security/hardware-security/index.md @@ -1,7 +1,7 @@ --- title: Windows hardware security description: Learn more about hardware security features support in Windows. -ms.date: 07/28/2023 +ms.date: 07/10/2024 ms.topic: overview appliesto: --- diff --git a/windows/security/hardware-security/kernel-dma-protection-for-thunderbolt.md b/windows/security/hardware-security/kernel-dma-protection-for-thunderbolt.md index 6b5201c81c..d010c70d1c 100644 --- a/windows/security/hardware-security/kernel-dma-protection-for-thunderbolt.md +++ b/windows/security/hardware-security/kernel-dma-protection-for-thunderbolt.md @@ -4,7 +4,7 @@ description: Learn how Kernel DMA Protection protects Windows devices against dr ms.collection: - tier1 ms.topic: conceptual -ms.date: 01/09/2024 +ms.date: 07/10/2024 --- # Kernel DMA Protection @@ -20,16 +20,16 @@ Drive-by DMA attacks are attacks that occur while the owner of the system isn't ## How Windows protects against DMA drive-by attacks -Windows uses the system *Input/Output Memory Management Unit (IOMMU)* to block external peripherals from starting and performing DMA, unless the drivers for these peripherals support memory isolation (such as DMA-remapping). Peripherals with [DMA Remapping compatible drivers][LINK-1] will be automatically enumerated, started, and allowed to perform DMA to their assigned memory regions. +Windows uses the system *Input/Output Memory Management Unit (IOMMU)* to block external peripherals from starting and performing DMA, unless the drivers for these peripherals support memory isolation (such as DMA-remapping). Peripherals with [DMA Remapping compatible drivers][LINK-1] are automatically enumerated, started, and allowed to perform DMA to their assigned memory regions. -By default, peripherals with DMA Remapping incompatible drivers will be blocked from starting and performing DMA until an authorized user signs into the system or unlocks the screen. IT administrators can modify the default behavior applied to devices with DMA Remapping incompatible drivers using MDM or group policies. +By default, peripherals with DMA Remapping incompatible drivers are blocked from starting and performing DMA until an authorized user signs into the system or unlocks the screen. IT administrators can modify the default behavior applied to devices with DMA Remapping incompatible drivers using MDM or group policies. ## User experience When Kernel DMA Protection is enabled: -- Peripherals with DMA Remapping-compatible device drivers will be automatically enumerated and started -- Peripherals with DMA Remapping-incompatible drivers will be blocked from starting if the peripheral was plugged in before an authorized user logs in, or while the screen is locked. Once the system is unlocked, the peripheral driver will be started by the OS, and the peripheral will continue to function normally until the system is rebooted, or the peripheral is unplugged. The peripheral will continue to function normally if the user locks the screen or signs out of the system. +- Peripherals with DMA Remapping-compatible device drivers are automatically enumerated and started +- Peripherals with DMA Remapping-incompatible drivers are blocked from starting if the peripheral was plugged in before an authorized user logs in, or while the screen is locked. Once the system is unlocked, the peripheral driver is started by the OS, and the peripheral continues to function normally until the system is rebooted, or the peripheral is unplugged. The peripheral will continue to function normally if the user locks the screen or signs out of the system. [!INCLUDE [kernel-direct-memory-access-dma-protection](../../../includes/licensing/kernel-direct-memory-access-dma-protection.md)] @@ -44,7 +44,7 @@ Kernel DMA Protection isn't compatible with other BitLocker DMA attacks counterm ## Check if Kernel DMA Protection is enabled -Systems that support Kernel DMA Protection will enable the feature automatically, with no user or IT admin configuration required. +Systems that support Kernel DMA Protection enable the feature automatically, with no user or IT admin configuration required. You can use the Windows Security settings to check if Kernel DMA Protection is enabled: @@ -53,7 +53,7 @@ You can use the Windows Security settings to check if Kernel DMA Protection is e :::image type="content" source="images/kernel-dma-protection-security-center.png" alt-text="Screenshot of Kernel DMA protection in Windows Security." lightbox="images/kernel-dma-protection-security-center.png" border="true"::: - Alternatively, you can use the System Information desktop app (`msinfo32.exe`). If the system supports Kernel DMA Protection, the **Kernel DMA Protection** value will be set to **ON**. + Alternatively, you can use the System Information desktop app (`msinfo32.exe`). If the system supports Kernel DMA Protection, the **Kernel DMA Protection** value is set to **ON**. :::image type="content" source="images/kernel-dma-protection.png" alt-text="Screenshot of Kernel DMA protection in System Information." lightbox="images/kernel-dma-protection.png" border="true"::: @@ -91,7 +91,7 @@ Use the Windows-provided drivers for the peripherals, when available. If there a ### My system's Kernel DMA Protection is off. Can DMA-remapping for a specific device be turned on? -Yes. DMA remapping for a specific device can be turned on independent from Kernel DMA Protection. For example, if the driver opts in and VT-d (Virtualization Technology for Directed I/O) is turned on, then DMA remapping will be enabled for the devices driver even if Kernel DMA Protection is turned off. +Yes. DMA remapping for a specific device can be turned on independent from Kernel DMA Protection. For example, if the driver opts in and VT-d (Virtualization Technology for Directed I/O) is turned on, then DMA remapping is enabled for the devices driver even if Kernel DMA Protection is turned off. Kernel DMA Protection is a policy that allows or blocks devices to perform DMA, based on their remapping state and capabilities. @@ -117,5 +117,4 @@ The policy can be enabled by using: [LINK-1]: /windows-hardware/drivers/pci/enabling-dma-remapping-for-device-drivers [LINK-2]: /windows/client-management/mdm/policy-csp-dmaguard#dmaguard-policies [LINK-3]: /windows-hardware/design/device-experiences/oem-kernel-dma-protection - [EXT-1]: https://thunderbolttechnology.net/security/Thunderbolt%203%20and%20Security.pdf diff --git a/windows/security/hardware-security/pluton/microsoft-pluton-security-processor.md b/windows/security/hardware-security/pluton/microsoft-pluton-security-processor.md index eb190c2bac..66feedfe73 100644 --- a/windows/security/hardware-security/pluton/microsoft-pluton-security-processor.md +++ b/windows/security/hardware-security/pluton/microsoft-pluton-security-processor.md @@ -2,7 +2,7 @@ title: Microsoft Pluton security processor description: Learn more about Microsoft Pluton security processor ms.topic: conceptual -ms.date: 02/19/2024 +ms.date: 07/10/2024 --- # Microsoft Pluton security processor @@ -13,7 +13,7 @@ Microsoft Pluton is currently available on devices with Ryzen 6000 and Qualcomm ## What is Microsoft Pluton? -Designed by Microsoft and built by silicon partners, Microsoft Pluton is a secure crypto-processor built into the CPU for security at the core to ensure code integrity and the latest protection with updates delivered by Microsoft through Windows Update. Pluton protects credentials, identities, personal data and encryption keys. Information is significantly harder to be removed even if an attacker installs malware or has complete physical possession of the PC. +Designed by Microsoft and built by silicon partners, Microsoft Pluton is a secure crypto-processor built into the CPU for security at the core to ensure code integrity and the latest protection with updates delivered by Microsoft through Windows Update. Pluton protects credentials, identities, personal data, and encryption keys. Information is significantly harder to be removed even if an attacker installs malware or has complete physical possession of the PC. Microsoft Pluton is designed to provide the functionality of the Trusted Platform Module (TPM) and deliver other security functionality beyond what is possible with the TPM 2.0 specification, and allows for other Pluton firmware and OS features to be delivered over time via Windows Update. For more information, see [Microsoft Pluton as TPM](pluton-as-tpm.md). diff --git a/windows/security/hardware-security/pluton/pluton-as-tpm.md b/windows/security/hardware-security/pluton/pluton-as-tpm.md index ccde7ec921..2946f43e11 100644 --- a/windows/security/hardware-security/pluton/pluton-as-tpm.md +++ b/windows/security/hardware-security/pluton/pluton-as-tpm.md @@ -2,12 +2,12 @@ title: Microsoft Pluton as Trusted Platform Module (TPM 2.0) description: Learn more about Microsoft Pluton security processor as Trusted Platform Module (TPM 2.0) ms.topic: conceptual -ms.date: 02/19/2024 +ms.date: 07/10/2024 --- # Microsoft Pluton as Trusted Platform Module -Microsoft Pluton is designed to provide the functionality of the Trusted Platform Module (TPM) thereby establishing the silicon root of trust. Microsoft Pluton supports the TPM 2.0 industry standard allowing customers to immediately benefit from the enhanced security in Windows features that rely on TPM including BitLocker, Windows Hello, and Windows Defender System Guard. +Microsoft Pluton is designed to provide the functionality of the Trusted Platform Module (TPM) thereby establishing the silicon root of trust. Microsoft Pluton supports the TPM 2.0 industry standard allowing customers to immediately benefit from the enhanced security in Windows features that rely on TPM including BitLocker, Windows Hello, and System Guard. As with other TPMs, credentials, encryption keys, and other sensitive information can't be easily extracted from Pluton even if an attacker installs malware or has complete physical possession of the device. Storing sensitive data like encryption keys securely within the Pluton processor, which is isolated from the rest of the system, helps ensure that emerging attack techniques such as speculative execution can't access key material. @@ -17,7 +17,7 @@ To learn more about the TPM related scenarios that benefit from Pluton, see [TPM ## Microsoft Pluton as a security processor alongside discrete TPM -Microsoft Pluton can be used as a TPM, or in conjunction with a TPM. Although Pluton builds security directly into the CPU, device manufacturers may choose to use discrete TPM as the default TPM, while having Pluton available to the system as a security processor for use cases beyond the TPM. +Microsoft Pluton can be used as a TPM, or with a TPM. Although Pluton builds security directly into the CPU, device manufacturers might choose to use discrete TPM as the default TPM, while having Pluton available to the system as a security processor for use cases beyond the TPM. Pluton is integrated within the SoC subsystem, and provides a flexible, updatable platform for running firmware that implements end-to-end security functionality authored, maintained, and updated by Microsoft. diff --git a/windows/security/hardware-security/system-guard-secure-launch-and-smm-protection.md b/windows/security/hardware-security/system-guard-secure-launch-and-smm-protection.md index 35ef8a1826..153871eba2 100644 --- a/windows/security/hardware-security/system-guard-secure-launch-and-smm-protection.md +++ b/windows/security/hardware-security/system-guard-secure-launch-and-smm-protection.md @@ -1,14 +1,13 @@ --- title: System Guard Secure Launch and SMM protection -description: Explains how to configure System Guard Secure Launch and System Management Mode (SMM protection) to improve the startup security of Windows 10 devices. -ms.localizationpriority: medium -ms.date: 07/31/2023 +description: Explains how to configure System Guard Secure Launch and System Management Mode (SMM protection) to improve the startup security of Windows devices. +ms.date: 07/10/2024 ms.topic: conceptual --- # System Guard Secure Launch and SMM protection -This topic explains how to configure [System Guard Secure Launch and System Management Mode (SMM) protection](how-hardware-based-root-of-trust-helps-protect-windows.md) to improve the startup security of Windows 10 and Windows 11 devices. The information below is presented from a client perspective. +This article explains how to configure [System Guard Secure Launch and System Management Mode (SMM) protection](how-hardware-based-root-of-trust-helps-protect-windows.md) to improve the startup security of Windows 10 and Windows 11 devices. The information below is presented from a client perspective. > [!NOTE] > System Guard Secure Launch feature requires a supported processor. For more information, see [System requirements for System Guard](how-hardware-based-root-of-trust-helps-protect-windows.md#system-requirements-for-system-guard). @@ -28,35 +27,30 @@ System Guard Secure Launch can be configured for Mobile Device Management (MDM) ### Group Policy -1. Click **Start** > type and then click **Edit group policy**. - -2. Click **Computer Configuration** > **Administrative Templates** > **System** > **Device Guard** > **Turn On Virtualization Based Security** > **Secure Launch Configuration**. +1. Select **Start** > type and then select **Edit group policy**. +1. Select **Computer Configuration** > **Administrative Templates** > **System** > **Device Guard** > **Turn On Virtualization Based Security** > **Secure Launch Configuration**. ![Secure Launch Configuration.](images/secure-launch-group-policy.png) ### Windows Security -Click **Start** > **Settings** > **Update & Security** > **Windows Security** > **Open Windows Security** > **Device security** > **Core isolation** > **Firmware protection**. +Select **Start** > **Settings** > **Update & Security** > **Windows Security** > **Open Windows Security** > **Device security** > **Core isolation** > **Firmware protection**. ![Windows Security settings.](images/secure-launch-security-app.png) ### Registry 1. Open Registry editor. - -2. Click **HKEY_LOCAL_MACHINE** > **SYSTEM** > **CurrentControlSet** > **Control** > **DeviceGuard** > **Scenarios**. - -3. Right-click **Scenarios** > **New** > **Key** and name the new key **SystemGuard**. - -4. Right-click **SystemGuard** > **New** > **DWORD (32-bit) Value** and name the new DWORD **Enabled**. - -5. Double-click **Enabled**, change the value to **1**, and click **OK**. +1. Select **HKEY_LOCAL_MACHINE** > **SYSTEM** > **CurrentControlSet** > **Control** > **DeviceGuard** > **Scenarios**. +1. Right-click **Scenarios** > **New** > **Key** and name the new key **SystemGuard**. +1. Right-click **SystemGuard** > **New** > **DWORD (32-bit) Value** and name the new DWORD **Enabled**. +1. Double-click **Enabled**, change the value to **1**, and click **OK**. ![Secure Launch Registry.](images/secure-launch-registry.png) ## How to verify System Guard Secure Launch is configured and running -To verify that Secure Launch is running, use System Information (MSInfo32). Click **Start**, search for **System Information**, and look under **Virtualization-based Security Services Running** and **Virtualization-based Security Services Configured**. +To verify that Secure Launch is running, use System Information (MSInfo32). Select **Start**, search for **System Information**, and look under **Virtualization-based Security Services Running** and **Virtualization-based Security Services Configured**. ![Verifying Secure Launch is running in the Windows Security settings.](images/secure-launch-msinfo.png) diff --git a/windows/security/hardware-security/tpm/backup-tpm-recovery-information-to-ad-ds.md b/windows/security/hardware-security/tpm/backup-tpm-recovery-information-to-ad-ds.md index 9be58182e9..7a1c590a9a 100644 --- a/windows/security/hardware-security/tpm/backup-tpm-recovery-information-to-ad-ds.md +++ b/windows/security/hardware-security/tpm/backup-tpm-recovery-information-to-ad-ds.md @@ -2,7 +2,7 @@ title: Back up TPM recovery information to Active Directory description: Learn how to back up the Trusted Platform Module (TPM) recovery information to Active Directory. ms.topic: conceptual -ms.date: 11/17/2023 +ms.date: 07/10/2024 --- # Back up the TPM recovery information to AD DS diff --git a/windows/security/hardware-security/tpm/change-the-tpm-owner-password.md b/windows/security/hardware-security/tpm/change-the-tpm-owner-password.md index 29abbe115b..37025f1eca 100644 --- a/windows/security/hardware-security/tpm/change-the-tpm-owner-password.md +++ b/windows/security/hardware-security/tpm/change-the-tpm-owner-password.md @@ -1,8 +1,8 @@ --- title: Change the TPM owner password -description: This topic for the IT professional describes how to change the password or PIN for the owner of the Trusted Platform Module (TPM) that is installed on your system. +description: This article for the IT professional describes how to change the password or PIN for the owner of the Trusted Platform Module (TPM) that is installed on your system. ms.topic: conceptual -ms.date: 11/17/2023 +ms.date: 07/10/2024 --- # Change the TPM owner password @@ -32,7 +32,6 @@ Without the owner password, you can still perform all the preceding actions with Instead of changing your owner password, you can also use the following options to manage your TPM: - **Clear the TPM** - If you want to invalidate all of the existing keys that have been created since you took ownership of the TPM, you can clear it. For important precautions for this process, and instructions for completing it, see [Clear all the keys from the TPM](initialize-and-configure-ownership-of-the-tpm.md#clear-all-the-keys-from-the-tpm). - - **Turn off the TPM** - With TPM 1.2 and Windows 10, versions 1507 and 1511, you can turn off the TPM. Turn off the TPM if you want to keep all existing keys and data intact and disable the services that are provided by the TPM. For more info, see [Turn off the TPM](initialize-and-configure-ownership-of-the-tpm.md#turn-off-the-tpm). ## Changing the TPM owner password @@ -44,7 +43,3 @@ To change to a new TPM owner password, in `TPM.msc`, select **Change Owner Passw ## Use the TPM cmdlets You can manage the TPM using Windows PowerShell. For details, see [TPM Cmdlets in Windows PowerShell](/powershell/module/trustedplatformmodule). - -## Related articles - -- [Trusted Platform Module](trusted-platform-module-overview.md) diff --git a/windows/security/hardware-security/tpm/how-windows-uses-the-tpm.md b/windows/security/hardware-security/tpm/how-windows-uses-the-tpm.md index fc6a8fad0f..a4d314ad3f 100644 --- a/windows/security/hardware-security/tpm/how-windows-uses-the-tpm.md +++ b/windows/security/hardware-security/tpm/how-windows-uses-the-tpm.md @@ -2,12 +2,12 @@ title: How Windows uses the TPM description: Learn how Windows uses the Trusted Platform Module (TPM) to enhance security. ms.topic: conceptual -ms.date: 11/17/2023 +ms.date: 07/10/2024 --- # How Windows uses the Trusted Platform Module -The Windows operating system places hardware-based security deeper inside many features, maximizing platform security while increasing usability. To achieve many of these security enhancements, Windows makes extensive use of the Trusted Platform Module (TPM). This article offers an overview of the TPM, describes how it works, and discusses the benefits that TPM brings to Windows and the cumulative security impact of running Windows on a device with a TPM. +The Windows operating system places hardware-based security deeper inside many features, maximizing platform security while increasing usability. To achieve many of these security enhancements, Windows makes extensive use of the Trusted Platform Module (TPM). This article offers an overview of the TPM, describes how it works, and discusses the benefits that TPM brings to Windows and the cumulative security effect of running Windows on a device with a TPM. ## TPM Overview @@ -21,7 +21,7 @@ The Trusted Computing Group (TCG) is the nonprofit organization that publishes a OEMs implement the TPM as a component in a trusted computing platform, such as a PC, tablet, or phone. Trusted computing platforms use the TPM to support privacy and security scenarios that software alone can't achieve. For example, software alone can't reliably report whether malware is present during the system startup process. The close integration between TPM and platform increases the transparency of the startup process and supports evaluating device health by enabling reliable measuring and reporting of the software that starts the device. Implementation of a TPM as part of a trusted computing platform provides a hardware root of trust-that is, it behaves in a trusted way. For example, if a key stored in a TPM has properties that disallow exporting the key, that key *truly can't leave the TPM*. -The TCG designed the TPM as a low-cost, mass-market security solution that addresses the requirements of different customer segments. There are variations in the security properties of different TPM implementations just as there are variations in customer and regulatory requirements for different sectors. In public-sector procurement, for example, some governments have clearly defined security requirements for TPMs, whereas others don't. +The TCG designed the TPM as a low-cost, mass-market security solution that addresses the requirements of different customer segments. There are variations in the security properties of different TPM implementations just as there are variations in customer and regulatory requirements for different sectors. In public-sector procurement, for example, some governments clearly define security requirements for TPMs, whereas others don't. Certification programs for TPMs-and technology in general-continue to evolve as the speed of innovation increases. Although having a TPM is clearly better than not having a TPM, Microsoft's best advice is to determine your organization's security needs and research any regulatory requirements associated with procurement for your industry. The result is a balance between scenarios used, assurance level, cost, convenience, and availability. @@ -51,11 +51,11 @@ Smart cards are physical devices that typically store a single certificate and t In Windows, the Virtual Smart Card feature allows the TPM to mimic a permanently inserted smart card. The TPM becomes *something the user has* but still requires a PIN. While physical smart cards limit the number of PIN attempts before locking the card and requiring a reset, a virtual smart card relies on the TPM's dictionary attack protection to prevent too many PIN guesses. -For TPM-based virtual smart cards, the TPM protects the use and storage of the certificate private key, so that it can't be copied when it is in use or stored and used elsewhere. Using a component that is part of the system rather than a separate physical smart card, can reduce total cost of ownership. The *lost card* or *card left at home* scenarios are not applicable, and the benefits of smart card-based multifactor authentication is preserved. For users, virtual smart cards are simple to use, requiring only a PIN to unlock. Virtual smart cards support the same scenarios that physical smart cards support, including signing in to Windows or authenticating for resource access. +For TPM-based virtual smart cards, the TPM protects the use and storage of the certificate private key, so that it can't be copied when it is in use or stored and used elsewhere. Using a component that is part of the system rather than a separate physical smart card, can reduce total cost of ownership. The *lost card* or *card left at home* scenarios aren't applicable, and the benefits of smart card-based multifactor authentication is preserved. For users, virtual smart cards are simple to use, requiring only a PIN to unlock. Virtual smart cards support the same scenarios that physical smart cards support, including signing in to Windows or authenticating for resource access. ## Windows Hello for Business -Windows Hello for Business provides authentication methods intended to replace passwords, which can be difficult to remember and easily compromised. In addition, username/password solutions for authentication often reuse the same credential combinations on multiple devices and services. If those credentials are compromised, they are compromised in multiple places. Windows Hello for Business combines the information provisioned on each device (i.e., the cryptographic key) with additional information to authenticate users. On a system that has a TPM, the TPM can protect the key. If a system does not have a TPM, software-based techniques protect the key. The additional information the user supplies can be a PIN value or, if the system has the necessary hardware, biometric information, such as fingerprint or facial recognition. To protect privacy, the biometric information is used only on the provisioned device to access the provisioned key: it is not shared across devices. +Windows Hello for Business provides authentication methods intended to replace passwords, which can be difficult to remember and easily compromised. In addition, username/password solutions for authentication often reuse the same credential combinations on multiple devices and services. If those credentials are compromised, they're compromised in multiple places. Windows Hello for Business combines the information provisioned on each device (that is, the cryptographic key) with additional information to authenticate users. On a system that has a TPM, the TPM can protect the key. If a system doesn't have a TPM, software-based techniques protect the key. The additional information the user supplies can be a PIN value or, if the system has the necessary hardware, biometric information, such as fingerprint or facial recognition. To protect privacy, the biometric information is used only on the provisioned device to access the provisioned key: it isn't shared across devices. The adoption of new authentication technology requires that identity providers and organizations deploy and use that technology. Windows Hello for Business lets users authenticate with their existing Microsoft account, an Active Directory account, a Microsoft Entra account, or even non-Microsoft Identity Provider Services or Relying Party Services that support [Fast ID Online V2.0 authentication](https://go.microsoft.com/fwlink/p/?LinkId=533889). @@ -63,7 +63,7 @@ Identity providers have flexibility in how they provision credentials on client - **Endorsement key**. The TPM manufacturer can create a special key in the TPM called an endorsement key. An endorsement key certificate, signed by the manufacturer, says that the endorsement key is present in a TPM that the manufacturer made. Solutions can use the certificate with the TPM containing the endorsement key to confirm a scenario really involves a TPM from a specific TPM manufacturer (instead of malware acting like a TPM). -- **Attestation identity key**. To protect privacy, most TPM scenarios do not directly use an actual endorsement key. Instead, they use attestation identity keys, and an identity certificate authority (CA) uses the endorsement key and its certificate to prove that one or more attestation identity keys actually exist in a real TPM. The identity CA issues attestation identity key certificates. More than one identity CA will generally see the same endorsement key certificate that can uniquely identify the TPM, but any number of attestation identity key certificates can be created to limit the information shared in other scenarios. +- **Attestation identity key**. To protect privacy, most TPM scenarios don't directly use an actual endorsement key. Instead, they use attestation identity keys, and an identity certificate authority (CA) uses the endorsement key and its certificate to prove that one or more attestation identity keys actually exist in a real TPM. The identity CA issues attestation identity key certificates. More than one identity CA will generally see the same endorsement key certificate that can uniquely identify the TPM, but any number of attestation identity key certificates can be created to limit the information shared in other scenarios. :::image type="content" alt-text="TPM Capabilities." source="images/tpm-capabilities.png" lightbox="images/tpm-capabilities.png"::: *Figure 1: TPM Cryptographic Key Management* @@ -72,15 +72,15 @@ For Windows Hello for Business, Microsoft can fill the role of the identity CA. ## BitLocker Drive Encryption -BitLocker provides full-volume encryption to protect data at rest. The most common device configuration splits the hard drive into several volumes. The operating system and user data reside on one volume that holds confidential information, and other volumes hold public information such as boot components, system information and recovery tools. (These other volumes are used infrequently enough that they do not need to be visible to users.) Without more protections in place, if the volume containing the operating system and user data is not encrypted, someone can boot another operating system and easily bypass the intended operating system's enforcement of file permissions to read any user data. +BitLocker provides full-volume encryption to protect data at rest. The most common device configuration splits the hard drive into several volumes. The operating system and user data reside on one volume that holds confidential information, and other volumes hold public information such as boot components, system information and recovery tools. (These other volumes are used infrequently enough that they don't need to be visible to users.) Without more protections in place, if the volume containing the operating system and user data isn't encrypted, someone can boot another operating system and easily bypass the intended operating system's enforcement of file permissions to read any user data. -In the most common configuration, BitLocker encrypts the operating system volume so that if the computer or hard disk is lost or stolen when powered off, the data on the volume remains confidential. When the computer is turned on, starts normally, and proceeds to the Windows logon prompt, the only path forward is for the user to log on with his or her credentials, allowing the operating system to enforce its normal file permissions. If something about the boot process changes, however-for example, a different operating system is booted from a USB device-the operating system volume and user data can't be read and are not accessible. The TPM and system firmware collaborate to record measurements of how the system started, including loaded software and configuration details such as whether boot occurred from the hard drive or a USB device. BitLocker relies on the TPM to allow the use of a key only when startup occurs in an expected way. The system firmware and TPM are carefully designed to work together to provide the following capabilities: +In the most common configuration, BitLocker encrypts the operating system volume so that if the computer or hard disk is lost or stolen when powered off, the data on the volume remains confidential. When the computer is turned on, starts normally, and proceeds to the Windows sign-in prompt, the only path forward is for the user to sign in with their credentials, allowing the operating system to enforce its normal file permissions. If something about the boot process changes, however-for example, a different operating system is booted from a USB device-the operating system volume and user data can't be read and aren't accessible. The TPM and system firmware collaborate to record measurements of how the system started, including loaded software and configuration details such as whether boot occurred from the hard drive or a USB device. BitLocker relies on the TPM to allow the use of a key only when startup occurs in an expected way. The system firmware and TPM are carefully designed to work together to provide the following capabilities: - **Hardware root of trust for measurement**. A TPM allows software to send it commands that record measurements of software or configuration information. This information can be calculated using a hash algorithm that essentially transforms a lot of data into a small, statistically unique hash value. The system firmware has a component called the Core Root of Trust for Measurement (CRTM) that is implicitly trusted. The CRTM unconditionally hashes the next software component and records the measurement value by sending a command to the TPM. Successive components, whether system firmware or operating system loaders, continue the process by measuring any software components they load before running them. Because each component's measurement is sent to the TPM before it runs, a component can't erase its measurement from the TPM. (However, measurements are erased when the system is restarted.) The result is that at each step of the system startup process, the TPM holds measurements of boot software and configuration information. Any changes in boot software or configuration yield different TPM measurements at that step and later steps. Because the system firmware unconditionally starts the measurement chain, it provides a hardware-based root of trust for the TPM measurements. At some point in the startup process, the value of recording all loaded software and configuration information diminishes and the chain of measurements stops. The TPM allows for the creation of keys that can be used only when the platform configuration registers that hold the measurements have specific values. -- **Key used only when boot measurements are accurate**. BitLocker creates a key in the TPM that can be used only when the boot measurements match an expected value. The expected value is calculated for the step in the startup process when Windows Boot Manager runs from the operating system volume on the system hard drive. Windows Boot Manager, which is stored unencrypted on the boot volume, needs to use the TPM key so that it can decrypt data read into memory from the operating system volume and startup can proceed using the encrypted operating system volume. If a different operating system is booted or the configuration is changed, the measurement values in the TPM will be different, the TPM will not let Windows Boot Manager use the key, and the startup process can't proceed normally because the data on the operating system can't be decrypted. If someone tries to boot the system with a different operating system or a different device, the software or configuration measurements in the TPM will be wrong and the TPM will not allow use of the key needed to decrypt the operating system volume. As a failsafe, if measurement values change unexpectedly, the user can always use the BitLocker recovery key to access volume data. Organizations can configure BitLocker to store the recovery key-in Active Directory Domain Services (AD DS). +- **Key used only when boot measurements are accurate**. BitLocker creates a key in the TPM that can be used only when the boot measurements match an expected value. The expected value is calculated for the step in the startup process when Windows Boot Manager runs from the operating system volume on the system hard drive. Windows Boot Manager, which is stored unencrypted on the boot volume, needs to use the TPM key so that it can decrypt data read into memory from the operating system volume and startup can proceed using the encrypted operating system volume. If a different operating system is booted or the configuration is changed, the measurement values in the TPM will be different, the TPM won't let Windows Boot Manager use the key, and the startup process can't proceed normally because the data on the operating system can't be decrypted. If someone tries to boot the system with a different operating system or a different device, the software or configuration measurements in the TPM will be wrong and the TPM won't allow use of the key needed to decrypt the operating system volume. As a failsafe, if measurement values change unexpectedly, the user can always use the BitLocker recovery key to access volume data. Organizations can configure BitLocker to store the recovery key-in Active Directory Domain Services (AD DS). -Device hardware characteristics are important to BitLocker and its ability to protect data. One consideration is whether the device provides attack vectors when the system is at the logon screen. For example, if the Windows device has a port that allows direct memory access so that someone can plug in hardware and read memory, an attacker can read the operating system volume's decryption key from memory while at the Windows logon screen. To mitigate this risk, organizations can configure BitLocker so that the TPM key requires both the correct software measurements and an authorization value. The system startup process stops at Windows Boot Manager, and the user is prompted to enter the authorization value for the TPM key or insert a USB device with the value. This process stops BitLocker from automatically loading the key into memory where it might be vulnerable, but has a less desirable user experience. +Device hardware characteristics are important to BitLocker and its ability to protect data. One consideration is whether the device provides attack vectors when the system is at the sign-in screen. For example, if the Windows device has a port that allows direct memory access so that someone can plug in hardware and read memory, an attacker can read the operating system volume's decryption key from memory while at the Windows sign-in screen. To mitigate this risk, organizations can configure BitLocker so that the TPM key requires both the correct software measurements and an authorization value. The system startup process stops at Windows Boot Manager, and the user is prompted to enter the authorization value for the TPM key or insert a USB device with the value. This process stops BitLocker from automatically loading the key into memory where it might be vulnerable, but has a less desirable user experience. Newer hardware and Windows work better together to disable direct memory access through ports and reduce attack vectors. The result is that organizations can deploy more systems without requiring users to enter additional authorization information during the startup process. The right hardware allows BitLocker to be used with the "TPM-only" configuration giving users a single sign-on experience without having to enter a PIN or USB key during boot. @@ -92,17 +92,17 @@ For software measurements, Device Encryption relies on measurements of the autho ## Measured Boot -Windows 8 introduced Measured Boot as a way for the operating system to record the chain of measurements of software components and configuration information in the TPM through the initialization of the Windows operating system. In previous Windows versions, the measurement chain stopped at the Windows Boot Manager component itself, and the measurements in the TPM were not helpful for understanding the starting state of Windows. +Windows 8 introduced Measured Boot as a way for the operating system to record the chain of measurements of software components and configuration information in the TPM through the initialization of the Windows operating system. In previous Windows versions, the measurement chain stopped at the Windows Boot Manager component itself, and the measurements in the TPM weren't helpful for understanding the starting state of Windows. -The Windows boot process happens in stages and often involves non-Microsoft drivers to communicate with vendor-specific hardware or implement antimalware solutions. For software, Measured Boot records measurements of the Windows kernel, Early-Launch Anti-Malware drivers, and boot drivers in the TPM. For configuration settings, Measured Boot records security-relevant information such as signature data that antimalware drivers use and configuration data about Windows security features (e.g., whether BitLocker is on or off). +The Windows boot process happens in stages and often involves non-Microsoft drivers to communicate with vendor-specific hardware or implement anti-malware solutions. For software, Measured Boot records measurements of the Windows kernel, Early-Launch anti-malware drivers, and boot drivers in the TPM. For configuration settings, Measured Boot records security-relevant information such as signature data that anti-malware drivers use and configuration data about Windows security features (for example, whether BitLocker is on or off). Measured Boot ensures that TPM measurements fully reflect the starting state of Windows software and configuration settings. If security settings and other protections are set up correctly, they can be trusted to maintain the security of the running operating system thereafter. Other scenarios can use the operating system's starting state to determine whether the running operating system should be trusted. -TPM measurements are designed to avoid recording any privacy-sensitive information as a measurement. As an additional privacy protection, Measured Boot stops the measurement chain at the initial starting state of Windows. Therefore, the set of measurements does not include details about which applications are in use or how Windows is being used. Measurement information can be shared with external entities to show that the device is enforcing adequate security policies and did not start with malware. +TPM measurements are designed to avoid recording any privacy-sensitive information as a measurement. As an additional privacy protection, Measured Boot stops the measurement chain at the initial starting state of Windows. Therefore, the set of measurements doesn't include details about which applications are in use or how Windows is being used. Measurement information can be shared with external entities to show that the device is enforcing adequate security policies and didn't start with malware. The TPM provides the following way for scenarios to use the measurements recorded in the TPM during boot: -- **Remote Attestation**. Using an attestation identity key, the TPM can generate and cryptographically sign a statement (or*quote*) of the current measurements in the TPM. Windows can create unique attestation identity keys for various scenarios to prevent separate evaluators from collaborating to track the same device. Additional information in the quote is cryptographically scrambled to limit information sharing and better protect privacy. By sending the quote to a remote entity, a device can attest which software and configuration settings were used to boot the device and initialize the operating system. An attestation identity key certificate can provide further assurance that the quote is coming from a real TPM. Remote attestation is the process of recording measurements in the TPM, generating a quote, and sending the quote information to another system that evaluates the measurements to establish trust in a device. Figure 2 illustrates this process. +- **Remote Attestation**. Using an attestation identity key, the TPM can generate and cryptographically sign a statement (or *quote*) of the current measurements in the TPM. Windows can create unique attestation identity keys for various scenarios to prevent separate evaluators from collaborating to track the same device. Additional information in the quote is cryptographically scrambled to limit information sharing and better protect privacy. By sending the quote to a remote entity, a device can attest which software and configuration settings were used to boot the device and initialize the operating system. An attestation identity key certificate can provide further assurance that the quote is coming from a real TPM. Remote attestation is the process of recording measurements in the TPM, generating a quote, and sending the quote information to another system that evaluates the measurements to establish trust in a device. Figure 2 illustrates this process. When new security features are added to Windows, Measured Boot adds security-relevant configuration information to the measurements recorded in the TPM. Measured Boot enables remote attestation scenarios that reflect the system firmware and the Windows initialization state. @@ -111,24 +111,22 @@ When new security features are added to Windows, Measured Boot adds security-rel ## Health Attestation -Some Windows improvements help security solutions implement remote attestation scenarios. Microsoft provides a Health Attestation service, which can create attestation identity key certificates for TPMs from different manufacturers as well as parse measured boot information to extract simple security assertions, such as whether BitLocker is on or off. The simple security assertions can be used to evaluate device health. +Some Windows improvements help security solutions implement remote attestation scenarios. Microsoft provides a Health Attestation service, which can create attestation identity key certificates for TPMs from different manufacturers and parse measured boot information to extract simple security assertions, such as whether BitLocker is on or off. The simple security assertions can be used to evaluate device health. Mobile device management (MDM) solutions can receive simple security assertions from the Microsoft Health Attestation service for a client without having to deal with the complexity of the quote or the detailed TPM measurements. MDM solutions can act on the security information by quarantining unhealthy devices or blocking access to cloud services such as Microsoft Office 365. ## Credential Guard -Credential Guard is a new feature in Windows that helps protect Windows credentials in organizations that have deployed AD DS. Historically, a user's credentials (such as a logon password) were hashed to generate an authorization token. The user employed the token to access resources that he or she was permitted to use. One weakness of the token model is that malware that had access to the operating system kernel could look through the computer's memory and harvest all the access tokens currently in use. The attacker could then use harvested tokens to log on to other machines and collect more credentials. This kind of attack is called a "pass the hash" attack, a malware technique that infects one machine to infect many machines across an organization. +Credential Guard is a new feature in Windows that helps protect Windows credentials in organizations that have deployed AD DS. Historically, a user's credentials (such as a sign-in password) were hashed to generate an authorization token. The user employed the token to access resources that they were permitted to use. One weakness of the token model is that malware that had access to the operating system kernel could look through the computer's memory and harvest all the access tokens currently in use. The attacker could then use harvested tokens to sign in to other machines and collect more credentials. This kind of attack is called a "pass the hash" attack, a malware technique that infects one machine to infect many machines across an organization. -Similar to the way Microsoft Hyper-V keeps virtual machines (VMs) separate from one another, Credential Guard uses virtualization to isolate the process that hashes credentials in a memory area that the operating system kernel can't access. This isolated memory area is initialized and protected during the boot process so that components in the larger operating system environment can't tamper with it. Credential Guard uses the TPM to protect its keys with TPM measurements, so they are accessible only during the boot process step when the separate region is initialized; they are not available for the normal operating system kernel. The local security authority code in the Windows kernel interacts with the isolated memory area by passing in credentials and receiving single-use authorization tokens in return. +Similar to the way Microsoft Hyper-V keeps virtual machines (VMs) separate from one another, Credential Guard uses virtualization to isolate the process that hashes credentials in a memory area that the operating system kernel can't access. This isolated memory area is initialized and protected during the boot process so that components in the larger operating system environment can't tamper with it. Credential Guard uses the TPM to protect its keys with TPM measurements, so they're accessible only during the boot process step when the separate region is initialized; they aren't available for the normal operating system kernel. The local security authority code in the Windows kernel interacts with the isolated memory area by passing in credentials and receiving single-use authorization tokens in return. -The resulting solution provides defense in depth, because even if malware runs in the operating system kernel, it can't access the secrets inside the isolated memory area that actually generates authorization tokens. The solution does not solve the problem of key loggers because the passwords such loggers capture actually pass through the normal Windows kernel, but when combined with other solutions, such as smart cards for authentication, Credential Guard greatly enhances the protection of credentials in Windows. +The resulting solution provides defense in depth, because even if malware runs in the operating system kernel, it can't access the secrets inside the isolated memory area that actually generates authorization tokens. The solution doesn't solve the problem of key loggers because the passwords such loggers capture actually pass through the normal Windows kernel, but when combined with other solutions, such as smart cards for authentication, Credential Guard greatly enhances the protection of credentials in Windows. ## Conclusion The TPM adds hardware-based security benefits to Windows. When installed on hardware that includes a TPM, Window delivers remarkably improved security benefits. The following table summarizes the key benefits of the TPM's major features. -
- | Feature | Benefits when used on a system with a TPM | |----------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Platform Crypto Provider | - If the machine is compromised, the private key associated with the certificate can't be copied off the device.
- The TPM's dictionary attack mechanism protects PIN values to use a certificate. | @@ -138,8 +136,6 @@ The TPM adds hardware-based security benefits to Windows. When installed on hard | Device Encryption | With a Microsoft account and the right hardware, consumers' devices seamlessly benefit from data-at-rest protection. | | Measured Boot | A hardware root of trust contains boot measurements that help detect malware during remote attestation. | | Health Attestation | MDM solutions can easily perform remote attestation and evaluate client health before granting access to resources or cloud services such as Office 365. | -| Credential Guard | Defense in depth increases so that even if malware has administrative rights on one machine, it is significantly more difficult to compromise additional machines in an organization. | +| Credential Guard | Defense in depth increases so that even if malware has administrative rights on one machine, it's significantly more difficult to compromise additional machines in an organization. | -
- -Although some of the aforementioned features have additional hardware requirements (e.g., virtualization support), the TPM is a cornerstone of Windows security. Microsoft and other industry stakeholders continue to improve the global standards associated with TPM and find more and more applications that use it to provide tangible benefits to customers. Microsoft has included support for most TPM features in its version of Windows for the Internet of Things (IoT) called [Windows IoT Core](/windows/iot-core/windows-iot-core). IoT devices that might be deployed in insecure physical locations and connected to cloud services like [Azure IoT Hub](https://azure.microsoft.com/documentation/services/iot-hub/) for management can use the TPM in innovative ways to address their emerging security requirements. +Although some of the aforementioned features have more hardware requirements (for example, virtualization support), the TPM is a cornerstone of Windows security. Microsoft and other industry stakeholders continue to improve the global standards associated with TPM and find more applications that use it to provide tangible benefits to customers. Microsoft has included support for most TPM features in its version of Windows for the Internet of Things (IoT) called [Windows IoT Core](/windows/iot-core/windows-iot-core). IoT devices that might be deployed in insecure physical locations and connected to cloud services like [Azure IoT Hub](https://azure.microsoft.com/documentation/services/iot-hub/) for management can use the TPM in innovative ways to address their emerging security requirements. diff --git a/windows/security/hardware-security/tpm/initialize-and-configure-ownership-of-the-tpm.md b/windows/security/hardware-security/tpm/initialize-and-configure-ownership-of-the-tpm.md index 9e08708019..bede99fdbe 100644 --- a/windows/security/hardware-security/tpm/initialize-and-configure-ownership-of-the-tpm.md +++ b/windows/security/hardware-security/tpm/initialize-and-configure-ownership-of-the-tpm.md @@ -2,7 +2,7 @@ title: Troubleshoot the TPM description: Learn how to view and troubleshoot the Trusted Platform Module (TPM). ms.topic: conceptual -ms.date: 11/17/2023 +ms.date: 07/10/2024 ms.collection: - tier1 --- @@ -13,9 +13,6 @@ This article provides information how to troubleshoot the Trusted Platform Modul - [Troubleshoot TPM initialization](#tpm-initialization) - [Clear all the keys from the TPM](#clear-all-the-keys-from-the-tpm) - -With TPM 1.2 and Windows 11, you can also take the following actions: - - [Turn on or turn off the TPM](#turn-on-or-turn-off-the-tpm) For information about the TPM cmdlets, see [TPM Cmdlets in Windows PowerShell](/powershell/module/trustedplatformmodule/?view=win10-ps&preserve-view=true). @@ -28,17 +25,17 @@ Windows automatically initializes and takes ownership of the TPM. There's no nee If you find that Windows isn't able to initialize the TPM automatically, review the following information: -- You can try clearing the TPM to the factory default values, allowing Windows to reinitialize it. For important precautions for this process, and instructions for completing it, see [Clear all the keys from the TPM](#clear-all-the-keys-from-the-tpm) -- If the TPM is a TPM 2.0 and isn't detected by Windows, verify that your computer hardware contains a Unified Extensible Firmware Interface (UEFI) that is Trusted Computing Group-compliant. Also, ensure that in the UEFI settings, the TPM hasn't been disabled or hidden from the operating system -- If you have TPM 1.2 with Windows 11, the TPM might be turned off, and need to be turned back on, as described in [Turn on the TPM](#turn-on-the-tpm). When it's turned back on, Windows will reinitialize it -- If you're attempting to set up BitLocker with the TPM, check which TPM driver is installed on the computer. We recommend always using one of the TPM drivers that is provided by Microsoft and is protected with BitLocker. If a non-Microsoft TPM driver is installed, it may prevent the default TPM driver from loading and cause BitLocker to report that a TPM isn't present on the computer. If you have a non-Microsoft driver installed, remove it, and then allow the operating system to initialize the TPM +- You can try clearing the TPM to the factory default values, allowing Windows to reinitialize it. For important precautions for this process, and instructions for completing it, see [Clear all the keys from the TPM](#clear-all-the-keys-from-the-tpm). +- If the TPM is a TPM 2.0 and isn't detected by Windows, verify that your computer hardware contains a Unified Extensible Firmware Interface (UEFI) that is Trusted Computing Group-compliant. Also, ensure that in the UEFI settings, the TPM hasn't been disabled or hidden from the operating system. +- If you have TPM 1.2 with Windows 11, the TPM might be turned off, and need to be turned back on, as described in [Turn on the TPM](#turn-on-the-tpm). When it's turned back on, Windows reinitializes it. +- If you're attempting to set up BitLocker with the TPM, check which TPM driver is installed on the computer. We recommend always using one of the TPM drivers that is provided by Microsoft and is protected with BitLocker. If a non-Microsoft TPM driver is installed, it may prevent the default TPM driver from loading and cause BitLocker to report that a TPM isn't present on the computer. If you have a non-Microsoft driver installed, remove it, and then allow the operating system to initialize the TPM. ### Network connection issues for domain-joined Windows 11 devices If you have Windows 11, the initialization of the TPM can't complete when your computer has network connection issues and both of the following conditions exist: -- An administrator has configured your computer to require that TPM recovery information be saved in Active Directory Domain Services (AD DS). This requirement can be configured through group policy -- A domain controller can't be reached. This scenario may occur on a device that is currently disconnected from the internal network, separated from the domain by a firewall, or experiencing a network component failure (such as an unplugged cable or a faulty network adapter) +- An administrator has configured your computer to require that TPM recovery information be saved in Active Directory Domain Services (AD DS). This requirement can be configured through group policy. +- A domain controller can't be reached. This scenario may occur on a device that is currently disconnected from the internal network, separated from the domain by a firewall, or experiencing a network component failure (such as an unplugged cable or a faulty network adapter). If these issues occur, an error message appears, and you can't complete the initialization process. To avoid the issue, allow Windows to initialize the TPM while you're connected to the corporate network, and you can contact a domain controller. @@ -46,7 +43,7 @@ If these issues occur, an error message appears, and you can't complete the init Some systems may have multiple TPMs and the active TPM may be toggled in UEFI. Windows doesn't support this configuration. If you switch TPMs, Windows might not properly detect or interact with the new TPM. If you plan to switch TPMs, you should toggle to the new TPM, clear it, and reinstall Windows. For more information, see [Clear all the keys from the TPM](#clear-all-the-keys-from-the-tpm). -For example, toggling TPMs will cause BitLocker to enter recovery mode. We strongly recommend that, on systems with two TPMs, one TPM is selected to be used and the selection isn't changed. +For example, toggling TPMs cause BitLocker to enter recovery mode. We strongly recommend that, on systems with two TPMs, one TPM is selected for use and the selection isn't changed. ## Clear all the keys from the TPM @@ -61,11 +58,11 @@ Clearing the TPM resets it to an unowned state. After you clear the TPM, the Win Clearing the TPM can result in data loss. To protect against such loss, review the following precautions: -- Clearing the TPM causes you to lose all created keys associated with the TPM, and data protected by those keys, such as a virtual smart card or a sign-in PIN. Make sure that you have a backup and recovery method for any data that is protected or encrypted by the TPM -- Don't clear the TPM on a device you don't own, such as a work or school PC, without being instructed to do so by your IT administrator -- If you want to temporarily suspend TPM operations on Windows 11, you can turn off the TPM. For more information, see [Turn off the TPM](#turn-off-the-tpm) -- Always use functionality in the operating system (such as TPM.msc) to the clear the TPM. Don't clear the TPM directly from UEFI -- Because your TPM security hardware is a physical part of your computer, before clearing the TPM, you might want to read the manuals or instructions that came with your computer, or search the manufacturer's website +- Clearing the TPM causes you to lose all created keys associated with the TPM, and data protected by those keys, such as a virtual smart card or a sign-in PIN. Make sure that you have a backup and recovery method for any data that is protected or encrypted by the TPM. +- Don't clear the TPM on a device you don't own, such as a work or school PC, without being instructed to do so by your IT administrator. +- If you want to temporarily suspend TPM operations on Windows 11, you can turn off the TPM. For more information, see [Turn off the TPM](#turn-off-the-tpm). +- Always use functionality in the operating system (such as TPM.msc) to clear the TPM. Don't clear the TPM directly from UEFI. +- Because your TPM security hardware is a physical part of your computer, before clearing the TPM, you might want to read the manuals or instructions that came with your computer, or search the manufacturer's website. Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure. @@ -76,7 +73,7 @@ Membership in the local Administrators group, or equivalent, is the minimum requ 1. Select **Security processor details**. 1. Select **Security processor troubleshooting**. 1. Select **Clear TPM**. - - You'll be prompted to restart the computer. During the restart, you might be prompted by the UEFI to press a button to confirm that you wish to clear the TPM. + - You'll be prompted to restart the computer. During the restart, you might be prompted to press a button to confirm that you wish to clear the TPM. - After the device restarts, your TPM will be automatically prepared for use by Windows. ## Turn on or turn off the TPM @@ -100,7 +97,7 @@ If you want to stop using the services that are provided by the TPM, you can use 1. Open the TPM MMC (`tpm.msc`). 1. In the **Action** pane, select **Turn TPM Off** to display the **Turn off the TPM security hardware** page. 1. In the **Turn off the TPM security hardware** dialog box, select a method to enter your owner password and turning off the TPM: - - If you saved your TPM owner password on a removable storage device, insert it, and then select **I have the owner password file**. In the **Select backup file with the TPM owner password** dialog box, select **Browse** to locate the *.tpm* file that is saved on your removable storage device, select **Open**, and then select **Turn TPM Off**. + - If you saved your TPM owner password on a removable storage device, insert it, and then select **I have the owner password file**. In the **Select backup file with the TPM owner password** dialog box, select **Browse** to locate the `.tpm` file that is saved on your removable storage device, select **Open**, and then select **Turn TPM Off**. - If you don't have the removable storage device with your saved TPM owner password, select **I want to enter the password**. In the **Type your TPM owner password** dialog box, type your password (including hyphens), and then select **Turn TPM Off**. - If you didn't save your TPM owner password or no longer know it, select **I do not have the TPM owner password**, and follow the instructions that are provided in the dialog box and subsequent UEFI screens to turn off the TPM without entering the password. diff --git a/windows/security/hardware-security/tpm/manage-tpm-commands.md b/windows/security/hardware-security/tpm/manage-tpm-commands.md index d309758d11..fc2bcfb404 100644 --- a/windows/security/hardware-security/tpm/manage-tpm-commands.md +++ b/windows/security/hardware-security/tpm/manage-tpm-commands.md @@ -2,14 +2,14 @@ title: Manage TPM commands description: This article for the IT professional describes how to manage which Trusted Platform Module (TPM) commands are available to domain users and to local users. ms.topic: conceptual -ms.date: 11/17/2023 +ms.date: 07/10/2024 --- # Manage TPM commands This article for the IT professional describes how to manage which Trusted Platform Module (TPM) commands are available to domain users and to local users. -After a computer user takes ownership of the TPM, the TPM owner can limit which TPM commands can be run by creating a list of blocked TPM commands. The list can be created and applied to all computers in a domain by using Group Policy, or a list can be created for individual computers by using the TPM MMC. Because some hardware vendors might provide additional commands or the Trusted Computing Group may decide to add commands in the future, the TPM MMC also supports the ability to block new commands. +After a computer user takes ownership of the TPM, the TPM owner can limit which TPM commands can be run by creating a list of blocked TPM commands. The list can be created and applied to all computers in a domain by using Group Policy, or a list can be created for individual computers by using the TPM MMC. Because some hardware vendors might provide more commands or the Trusted Computing Group might decide to add commands in the future, the TPM MMC also supports the ability to block new commands. The following procedures describe how to manage the TPM command lists. You must be a member of the local Administrators group. @@ -33,34 +33,24 @@ The following procedures describe how to manage the TPM command lists. You must > [!NOTE] > For a list of commands, see links in the [TPM Specification](https://www.trustedcomputinggroup.org/tpm-main-specification/). -1. After you have added numbers for each command that you want to block, select **OK** twice. +1. After adding numbers for each command that you want to block, select **OK** twice. 1. Close the Local Group Policy Editor. ## Block or allow TPM commands by using the TPM MMC 1. Open the TPM MMC (`tpm.msc`). If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then select **Yes**. - 1. In the console tree, select **Command Management**. A list of TPM commands is displayed. - 1. In the list, select a command that you want to block or allow. - 1. Under **Actions**, select **Block Selected Command** or **Allow Selected Command** as needed. If **Allow Selected Command** is unavailable, that command is currently blocked by Group Policy. ## Block new commands 1. Open the TPM MMC (`tpm.msc`). If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then select **Yes**. - 1. In the console tree, select **Command Management**. A list of TPM commands is displayed. - 1. In the **Action** pane, select **Block New Command**. The **Block New Command** dialog box is displayed. - 1. In the **Command Number** text box, type the number of the new command that you want to block, and then select **OK**. The command number you entered is added to the blocked list. ## Use the TPM cmdlets You can manage the TPM using Windows PowerShell. For details, see [TrustedPlatformModule PowerShell cmdlets](/powershell/module/trustedplatformmodule/?view=win10-ps&preserve-view=true). - -## Related articles - -- [Trusted Platform Module](trusted-platform-module-overview.md) diff --git a/windows/security/hardware-security/tpm/manage-tpm-lockout.md b/windows/security/hardware-security/tpm/manage-tpm-lockout.md index abf6374e8f..7dfa150354 100644 --- a/windows/security/hardware-security/tpm/manage-tpm-lockout.md +++ b/windows/security/hardware-security/tpm/manage-tpm-lockout.md @@ -2,7 +2,7 @@ title: Manage TPM lockout description: This article for the IT professional describes how to manage the lockout feature for the Trusted Platform Module (TPM) in Windows. ms.topic: conceptual -ms.date: 11/17/2023 +ms.date: 07/10/2024 --- # Manage TPM lockout @@ -21,11 +21,11 @@ In some cases, encryption keys are protected by a TPM by requiring a valid autho TPM 2.0 devices have standardized lockout behavior which Windows configures. TPM 2.0 devices have a maximum count threshold and a healing time. Windows configures the maximum count to be 32 and the healing time to be 10 minutes. This configuration means that every continuous 10 minutes of powered on operation without an event causes the counter to decrease by 1. -If your TPM has entered lockout mode or is responding slowly to commands, you can reset the lockout value by using the following procedures. Resetting the TPM lockout requires the TPM owner's authorization. This value is no longer retained by default starting with Windows 10 version 1607 and higher. +If your TPM is in lockout mode or is responding slowly to commands, you can reset the lockout value by using the following procedures. Resetting the TPM lockout requires the TPM owner's authorization. This value is no longer retained by default starting with Windows 10 version 1607 and higher. ### TPM 1.2 -The industry standards from the Trusted Computing Group (TCG) specify that TPM manufacturers must implement some form of protection logic in TPM 1.2 and TPM 2.0 chips. TPM 1.2 devices implement different protection mechanisms and behavior. In general, the TPM chip takes exponentially longer to respond if incorrect authorization values are sent to the TPM. Some TPM chips may not store failed attempts over time. Other TPM chips may store every failed attempt indefinitely. Therefore, some users may experience increasingly longer delays when they mistype an authorization value that is sent to the TPM. These delays can prevent them from using the TPM for a period of time. +The industry standards from the Trusted Computing Group (TCG) specify that TPM manufacturers must implement some form of protection logic in TPM 1.2 and TPM 2.0 chips. TPM 1.2 devices implement different protection mechanisms and behavior. In general, the TPM chip takes exponentially longer to respond if incorrect authorization values are sent to the TPM. Some TPM chips might not store failed attempts over time. Other TPM chips might store every failed attempt indefinitely. Therefore, some users might experience increasingly longer delays when they mistype an authorization value that is sent to the TPM. These delays can prevent them from using the TPM for some time. ## Reset the TPM lockout by using the TPM MMC @@ -73,7 +73,3 @@ For information about mitigating dictionary attacks that use the lockout setting ## Use the TPM cmdlets You can manage the TPM using Windows PowerShell. For details, see [TPM Cmdlets in Windows PowerShell](/powershell/module/trustedplatformmodule/). - -## Related articles - -- [Trusted Platform Module](trusted-platform-module-overview.md) diff --git a/windows/security/hardware-security/tpm/switch-pcr-banks-on-tpm-2-0-devices.md b/windows/security/hardware-security/tpm/switch-pcr-banks-on-tpm-2-0-devices.md index 281201247a..c3cd7b4d47 100644 --- a/windows/security/hardware-security/tpm/switch-pcr-banks-on-tpm-2-0-devices.md +++ b/windows/security/hardware-security/tpm/switch-pcr-banks-on-tpm-2-0-devices.md @@ -1,8 +1,8 @@ --- -title: UnderstandPCR banks on TPM 2.0 devices +title: Understand PCR banks on TPM 2.0 devices description: Learn about what happens when you switch PCR banks on TPM 2.0 devices. ms.topic: conceptual -ms.date: 11/17/2023 +ms.date: 07/10/2024 --- # PCR banks on TPM 2.0 devices @@ -27,9 +27,9 @@ It's important to note that this binding to PCR values also includes the hashing ## What happens when PCR banks are switched? -When the PCR banks are switched, the algorithm used to compute the hashed values stored in the PCRs during extend operations is changed. Each hash algorithm will return a different cryptographic signature for the same inputs. +When the PCR banks are switched, the algorithm used to compute the hashed values stored in the PCRs during extend operations is changed. Each hash algorithm returns a different cryptographic signature for the same inputs. -As a result, if the currently used PCR bank is switched all keys that have been bound to the previous PCR values will no longer work. For example, if you had a key bound to the SHA-1 value of PCR[12] and subsequently changed the PCR bank to SHA-256, the banks wouldn't match, and you would be unable to use that key. The BitLocker key is secured using the PCR banks and Windows won't be able to unseal it if the PCR banks are switched while BitLocker is enabled. +As a result, if the currently used PCR bank is switched, all keys that are bound to the previous PCR values no longer work. For example, if you had a key bound to the SHA-1 value of PCR[12] and later changed the PCR bank to SHA-256, the banks wouldn't match, and you would be unable to use that key. The BitLocker key is secured using the PCR banks and Windows can't unseal it if the PCR banks are switched while BitLocker is enabled. ## What can I do to switch PCRs when BitLocker is already active? @@ -43,7 +43,7 @@ You can configure a TPM to have multiple PCR banks active. When BIOS performs me - DWORD: `TPMActivePCRBanks` - Defines which PCR banks are currently active. This value should be interpreted as a bitmap for which the bits are defined in the [TCG Algorithm Registry](https://trustedcomputinggroup.org/resource/tcg-algorithm-registry/) Table 21 of Revision 1.27. -Windows checks which PCR banks are active and supported by the BIOS. Windows also checks if the measured boot log supports measurements for all active PCR banks. Windows will prefer the use of the SHA-256 bank for measurements and will fall back to SHA1 PCR bank if one of the pre-conditions isn't met. +Windows checks which PCR banks are active and supported by the BIOS. Windows also checks if the measured boot log supports measurements for all active PCR banks. Windows prefers the use of the SHA-256 bank for measurements and falls back to SHA1 PCR bank if one of the preconditions isn't met. You can identify which PCR bank is currently used by Windows by looking at the registry: @@ -51,4 +51,4 @@ You can identify which PCR bank is currently used by Windows by looking at the r - DWORD: `TPMDigestAlgID` - Algorithm ID of the PCR bank that Windows is currently using. This value represents an algorithm identifier as defined in the [TCG Algorithm Registry](https://trustedcomputinggroup.org/resource/tcg-algorithm-registry/) Table 3 of Revision 1.27. -Windows only uses one PCR bank to continue boot measurements. All other active PCR banks will be extended with a separator to indicate that they aren't used by Windows and measurements that appear to be from Windows shouldn't be trusted. +Windows only uses one PCR bank to continue boot measurements. All other active PCR banks are extended with a separator to indicate that they aren't used by Windows and measurements that appear to be from Windows shouldn't be trusted. diff --git a/windows/security/hardware-security/tpm/tpm-fundamentals.md b/windows/security/hardware-security/tpm/tpm-fundamentals.md index d4612701db..a6b202ab80 100644 --- a/windows/security/hardware-security/tpm/tpm-fundamentals.md +++ b/windows/security/hardware-security/tpm/tpm-fundamentals.md @@ -2,7 +2,7 @@ title: Trusted Platform Module (TPM) fundamentals description: Learn about the components of the Trusted Platform Module and how they're used to mitigate dictionary attacks. ms.topic: conceptual -ms.date: 11/17/2023 +ms.date: 07/10/2024 --- # TPM fundamentals @@ -98,7 +98,7 @@ TPM 2.0 allows some keys to be created without an authorization value associated Originally, BitLocker allowed from 4 to 20 characters for a PIN. Windows Hello has its own PIN for sign-in, which can be 4 to 127 characters. Both BitLocker and Windows Hello use the TPM to prevent PIN brute-force attacks. -Windows 10, version 1607 and earlier used Dictionary Attack Prevention parameters. The Dictionary Attack Prevention Parameters provide a way to balance security needs with usability. For example, when BitLocker is used with a TPM + PIN configuration, the number of PIN guesses is limited over time. A TPM 2.0 in this example could be configured to allow only 32 PIN guesses immediately, and then only one more guess every two hours. This totals a maximum of about 4415 guesses per year. If the PIN is four digits, all 9999 possible PIN combinations could be attempted in a little over two years. +Windows 10, version 1607 and earlier used Dictionary Attack Prevention parameters. The Dictionary Attack Prevention Parameters provide a way to balance security needs with usability. For example, when BitLocker is used with a TPM + PIN configuration, the number of PIN guesses is limited over time. A TPM 2.0 in this example could be configured to allow only 32 PIN guesses immediately, and then only one more guess every two hours. This totals a maximum of about 4,415 guesses per year. If the PIN is four digits, all 9999 possible PIN combinations could be attempted in a little over two years. Starting in Windows 10, version 1703, the minimum length for the BitLocker PIN was increased to six characters, to better align with other Windows features that use TPM 2.0, including Windows Hello. Increasing the PIN length requires a greater number of guesses for an attacker. Therefore, the lockout duration between each guess was shortened to allow legitimate users to retry a failed attempt sooner while maintaining a similar level of protection. In case the legacy parameters for lockout threshold and recovery time need to be used, make sure that GPO is enabled and [configure the system to use legacy Dictionary Attack Prevention Parameters setting for TPM 2.0](/windows/security/information-protection/tpm/trusted-platform-module-services-group-policy-settings#configure-the-system-to-use-legacy-dictionary-attack-prevention-parameters-setting-for-tpm-20). diff --git a/windows/security/hardware-security/tpm/tpm-recommendations.md b/windows/security/hardware-security/tpm/tpm-recommendations.md index 4471400a65..ae731d1f10 100644 --- a/windows/security/hardware-security/tpm/tpm-recommendations.md +++ b/windows/security/hardware-security/tpm/tpm-recommendations.md @@ -1,15 +1,15 @@ --- title: TPM recommendations -description: This topic provides recommendations for Trusted Platform Module (TPM) technology for Windows. +description: This article provides recommendations for Trusted Platform Module (TPM) technology for Windows. ms.topic: conceptual -ms.date: 11/17/2023 +ms.date: 07/10/2024 ms.collection: - tier1 --- # TPM recommendations -This topic provides recommendations for Trusted Platform Module (TPM) technology for Windows. +This article provides recommendations for Trusted Platform Module (TPM) technology for Windows. For a basic feature description of TPM, see the [Trusted Platform Module Technology Overview](trusted-platform-module-overview.md). @@ -17,24 +17,24 @@ For a basic feature description of TPM, see the [Trusted Platform Module Technol Traditionally, TPMs are discrete chips soldered to a computer's motherboard. Such implementations allow the computer's original equipment manufacturer (OEM) to evaluate and certify the TPM separate from the rest of the system. Discrete TPM implementations are common. However, they can be problematic for integrated devices that are small or have low power consumption. Some newer TPM implementations integrate TPM functionality into the same chipset as other platform components while still providing logical separation similar to discrete TPM chips. -TPMs are passive: they receive commands and return responses. To realize the full benefit of a TPM, the OEM must carefully integrate system hardware and firmware with the TPM to send it commands and react to its responses. TPMs were originally designed to provide security and privacy benefits to a platform's owner and users, but newer versions can provide security and privacy benefits to the system hardware itself. Before it can be used for advanced scenarios, however, a TPM must be provisioned. Windows automatically provisions a TPM, but if the user is planning to reinstall the operating system, he or she may need to clear the TPM before reinstalling so that Windows can take full advantage of the TPM. +TPMs are passive: they receive commands and return responses. To realize the full benefit of a TPM, the OEM must carefully integrate system hardware and firmware with the TPM to send it commands and react to its responses. TPMs were originally designed to provide security and privacy benefits to a platform's owner and users, but newer versions can provide security and privacy benefits to the system hardware itself. Before it can be used for advanced scenarios, however, a TPM must be provisioned. Windows automatically provisions a TPM, but if the user is planning to reinstall the operating system, they may need to clear the TPM before reinstalling so that Windows can take full advantage of the TPM. The Trusted Computing Group (TCG) is the nonprofit organization that publishes and maintains the TPM specification. The TCG exists to develop, define, and promote vendor-neutral, global industry standards. These standards support a hardware-based root of trust for interoperable trusted computing platforms. The TCG also publishes the TPM specification as the international standard ISO/IEC 11889, using the Publicly Available Specification Submission Process that the Joint Technical Committee 1 defines between the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). -OEMs implement the TPM as a component in a trusted computing platform, such as a PC, tablet, or phone. Trusted computing platforms use the TPM to support privacy and security scenarios that software alone cannot achieve. For example, software alone cannot reliably report whether malware is present during the system startup process. The close integration between TPM and platform increases the transparency of the startup process and supports evaluating device health by enabling reliable measuring and reporting of the software that starts the device. Implementation of a TPM as part of a trusted computing platform provides a hardware root of trust-that is, it behaves in a trusted way. For example, if a key stored in a TPM has properties that disallow exporting the key, that key truly cannot leave the TPM. +OEMs implement the TPM as a component in a trusted computing platform, such as a PC, tablet, or phone. Trusted computing platforms use the TPM to support privacy and security scenarios that software alone can't achieve. For example, software alone can't reliably report whether malware is present during the system startup process. The close integration between TPM and platform increases the transparency of the startup process and supports evaluating device health by enabling reliable measuring and reporting of the software that starts the device. Implementation of a TPM as part of a trusted computing platform provides a hardware root of trust-that is, it behaves in a trusted way. For example, if a key stored in a TPM has properties that disallow exporting the key, that key truly can't leave the TPM. -The TCG designed the TPM as a low-cost, mass-market security solution that addresses the requirements of different customer segments. There are variations in the security properties of different TPM implementations just as there are variations in customer and regulatory requirements for different sectors. In public-sector procurement, for example, some governments have clearly defined security requirements for TPMs whereas others do not. +The TCG designed the TPM as a low-cost, mass-market security solution that addresses the requirements of different customer segments. There are variations in the security properties of different TPM implementations just as there are variations in customer and regulatory requirements for different sectors. In public-sector procurement, for example, some governments clearly define security requirements for TPMs whereas others don't. ## TPM 1.2 vs. 2.0 comparison -From an industry standard, Microsoft has been an industry leader in moving and standardizing on TPM 2.0, which has many key realized benefits across algorithms, crypto, hierarchy, root keys, authorization and NV RAM. +From an industry standard, Microsoft has been an industry leader in moving and standardizing on TPM 2.0, which has many key realized benefits across algorithms, crypto, hierarchy, root keys, authorization, and NV RAM. ## Why TPM 2.0? TPM 2.0 products and systems have important security advantages over TPM 1.2, including: - The TPM 1.2 spec only allows for the use of RSA and the SHA-1 hashing algorithm. -- For security reasons, some entities are moving away from SHA-1. Notably, NIST has required many federal agencies to move to SHA-256 as of 2014, and technology leaders, including Microsoft and Google have announced they will remove support for SHA-1 based signing or certificates in 2017. +- For security reasons, some entities are moving away from SHA-1. Notably, NIST requires many federal agencies to move to SHA-256 as of 2014, and technology leaders, including Microsoft and Google have removed support for SHA-1 based signing or certificates in 2017. - TPM 2.0 **enables greater crypto agility** by being more flexible with respect to cryptographic algorithms. - TPM 2.0 supports newer algorithms, which can improve drive signing and key generation performance. For the full list of supported algorithms, see the [TCG Algorithm Registry](http://www.trustedcomputinggroup.org/tcg-algorithm-registry/). Some TPMs don't support all algorithms. - For the list of algorithms that Windows supports in the platform cryptographic storage provider, see [CNG Cryptographic Algorithm Providers](/windows/win32/seccertenroll/cng-cryptographic-algorithm-providers). @@ -58,7 +58,7 @@ There are three implementation options for TPMs: - Integrated TPM solution, using dedicated hardware integrated into one or more semiconductor packages alongside, but logically separate from, other components. - Firmware TPM solution, running the TPM in firmware in a Trusted Execution mode of a general purpose computation unit. -Windows uses any compatible TPM in the same way. Microsoft does not take a position on which way a TPM should be implemented and there is a wide ecosystem of available TPM solutions, which should suit all needs. +Windows uses any compatible TPM in the same way. Microsoft doesn't take a position on which way a TPM should be implemented and there's a wide ecosystem of available TPM solutions, which should suit all needs. ## Is there any importance for TPM for consumers? @@ -84,25 +84,21 @@ The following table defines which Windows features require TPM support. | Windows Features | TPM Required | Supports TPM 1.2 | Supports TPM 2.0 | Details | |--|--|--|--|--| -| Measured Boot | Yes | Yes | Yes | Measured Boot requires TPM 1.2 or 2.0 and UEFI Secure Boot. TPM 2.0 is recommended since it supports newer cryptographic algorithms. TPM 1.2 only supports the SHA-1 algorithm which is being deprecated. | +| Measured Boot | Yes | Yes | Yes | Measured Boot requires TPM 1.2 or 2.0 and UEFI Secure Boot. TPM 2.0 is recommended since it supports newer cryptographic algorithms. TPM 1.2 only supports the SHA-1 algorithm, which is being deprecated. | | BitLocker | No | Yes | Yes | TPM 1.2 or 2.0 are supported but TPM 2.0 is recommended. [Device Encryption requires Modern Standby](../../operating-system-security/data-protection/bitlocker/index.md#device-encryption) including TPM 2.0 support | | Device Encryption | Yes | N/A | Yes | Device Encryption requires Modern Standby/Connected Standby certification, which requires TPM 2.0. | | Windows Defender Application Control (Device Guard) | No | Yes | Yes | -| Windows Defender System Guard (DRTM) | Yes | No | Yes | TPM 2.0 and UEFI firmware is required. | -| Credential Guard | No | Yes | Yes | Windows 10, version 1507 (End of Life as of May 2017) only supported TPM 2.0 for Credential Guard. Beginning with Windows 10, version 1511, TPM 1.2 and 2.0 are supported. Paired with Windows Defender System Guard, TPM 2.0 provides enhanced security for Credential Guard. Windows 11 requires TPM 2.0 by default to facilitate easier enablement of this enhanced security for customers. | -| Device Health Attestation | Yes | Yes | Yes | TPM 2.0 is recommended since it supports newer cryptographic algorithms. TPM 1.2 only supports the SHA-1 algorithm which is being deprecated. | -| Windows Hello/Windows Hello for Business | No | Yes | Yes | Microsoft Entra join supports both versions of TPM, but requires TPM with keyed-hash message authentication code (HMAC) and Endorsement Key (EK) certificate for key attestation support. TPM 2.0 is recommended over TPM 1.2 for better performance and security. Windows Hello as a FIDO platform authenticator will take advantage of TPM 2.0 for key storage. | +| System Guard (DRTM) | Yes | No | Yes | TPM 2.0 and UEFI firmware is required. | +| Credential Guard | No | Yes | Yes | Windows 10, version 1507 (End of Life as of May 2017) only supported TPM 2.0 for Credential Guard. Beginning with Windows 10, version 1511, TPM 1.2 and 2.0 are supported. Paired with System Guard, TPM 2.0 provides enhanced security for Credential Guard. Windows 11 requires TPM 2.0 by default to facilitate easier enablement of this enhanced security for customers. | +| Device Health Attestation | Yes | Yes | Yes | TPM 2.0 is recommended since it supports newer cryptographic algorithms. TPM 1.2 only supports the SHA-1 algorithm, which is being deprecated. | +| Windows Hello/Windows Hello for Business | No | Yes | Yes | Microsoft Entra join supports both versions of TPM, but requires TPM with keyed-hash message authentication code (HMAC) and Endorsement Key (EK) certificate for key attestation support. TPM 2.0 is recommended over TPM 1.2 for better performance and security. Windows Hello as a FIDO platform authenticator takes advantage of TPM 2.0 for key storage. | | UEFI Secure Boot | No | Yes | Yes | | TPM Platform Crypto Provider Key Storage Provider | Yes | Yes | Yes | | Virtual Smart Card | Yes | Yes | Yes | | Certificate storage | No | Yes | Yes | TPM is only required when the certificate is stored in the TPM. | -| Autopilot | No | N/A | Yes | If you intend to deploy a scenario which requires TPM (such as white glove and self-deploying mode), then TPM 2.0 and UEFI firmware are required. | +| Autopilot | No | N/A | Yes | If you intend to deploy a scenario, which requires TPM (such as white glove and self-deploying mode), then TPM 2.0 and UEFI firmware are required. | | SecureBIO | Yes | No | Yes | TPM 2.0 and UEFI firmware is required. | ## OEM Status on TPM 2.0 system availability and certified parts Government customers and enterprise customers in regulated industries may have acquisition standards that require use of common certified TPM parts. As a result, OEMs, who provide the devices, may be required to use only certified TPM components on their commercial class systems. For more information, contact your OEM or hardware vendor. - -## Related topics - -- [Trusted Platform Module](trusted-platform-module-overview.md) diff --git a/windows/security/hardware-security/tpm/trusted-platform-module-overview.md b/windows/security/hardware-security/tpm/trusted-platform-module-overview.md index 46a0c61d51..372d8ad9ee 100644 --- a/windows/security/hardware-security/tpm/trusted-platform-module-overview.md +++ b/windows/security/hardware-security/tpm/trusted-platform-module-overview.md @@ -2,7 +2,7 @@ title: Trusted Platform Module Technology Overview description: Learn about the Trusted Platform Module (TPM) and how Windows uses it for access control and authentication. ms.topic: conceptual -ms.date: 11/17/2023 +ms.date: 07/10/2024 ms.collection: - tier1 --- diff --git a/windows/security/hardware-security/tpm/trusted-platform-module-services-group-policy-settings.md b/windows/security/hardware-security/tpm/trusted-platform-module-services-group-policy-settings.md index 4ea0c0f2d7..fdc858bcd3 100644 --- a/windows/security/hardware-security/tpm/trusted-platform-module-services-group-policy-settings.md +++ b/windows/security/hardware-security/tpm/trusted-platform-module-services-group-policy-settings.md @@ -1,13 +1,52 @@ --- title: TPM Group Policy settings -description: This topic describes the Trusted Platform Module (TPM) Services that can be controlled centrally by using Group Policy settings. +description: This article describes the Trusted Platform Module (TPM) Services that can be controlled centrally by using Group Policy settings. ms.topic: conceptual -ms.date: 11/17/2023 +ms.date: 07/10/2024 --- # TPM Group Policy settings -This topic describes the Trusted Platform Module (TPM) Services that can be controlled centrally by using Group Policy settings. The Group Policy settings for TPM services are located under **Computer Configuration** > **Administrative Templates** > **System** > **Trusted Platform Module Services**. +This article describes the Trusted Platform Module (TPM) Services that can be controlled centrally by using Group Policy settings. The Group Policy settings for TPM services are located under **Computer Configuration** > **Administrative Templates** > **System** > **Trusted Platform Module Services**. + +## Configure the list of blocked TPM commands + +This policy setting allows you to manage the Group Policy list of Trusted Platform Module (TPM) commands blocked by Windows. + +If you enable this policy setting, Windows blocks the specified commands from being sent to the TPM on the computer. TPM commands are referenced by a command number. For example, command number `129` is `TPM_OwnerReadInternalPub`, and command number `170` is `TPM_FieldUpgrade`. + +If you disable or don't configure this policy setting, only those TPM commands specified through the default or local lists may be blocked by Windows. The default list of blocked TPM commands is preconfigured by Windows. You can view the default list by running `tpm.msc`, navigating to the "Command Management" section, and making visible the "On Default Block List" column. The local list of blocked TPM commands is configured outside of Group Policy by running `tpm.msc` or through scripting against the Win32_Tpm interface. + +## Configure the system to clear the TPM if it is not in a ready state + +This policy setting configures the system to prompt the user to clear the TPM if the TPM is detected to be in any state other than Ready. This policy takes effect only if the system's TPM is in a state other than Ready, including if the TPM is "Ready, with reduced functionality". The prompt to clear the TPM will start occurring after the next reboot, upon user sign-in only if the logged in user is part of the Administrators group for the system. The prompt can be dismissed, but will reappear after every reboot and sign-in until the policy is disabled or until the TPM is in a Ready state. + +## Ignore the default list of blocked TPM commands + +This policy setting allows you to enforce or ignore the computer's local list of blocked Trusted Platform Module (TPM) commands. + +If you enable this policy setting, Windows ignores the computer's local list of blocked TPM commands and will only block those TPM commands specified by Group Policy or the default list. + +The local list of blocked TPM commands is configured outside of Group Policy by running `tpm.msc` or through scripting against the `Win32_Tpm` interface. The default list of blocked TPM commands is preconfigured by Windows. See the related policy setting to configure the Group Policy list of blocked TPM commands. + +If you disable or don't configure this policy setting, Windows blocks the TPM commands found in the local list, in addition to commands in the Group Policy and default lists of blocked TPM commands. + +## Ignore the local list of blocked TPM commands + +This policy setting configures how much of the TPM owner authorization information is stored in the registry of the local computer. Depending on the amount of TPM owner authorization information stored locally, the operating system and TPM-based applications can perform certain TPM actions, which require TPM owner authorization without requiring the user to enter the TPM owner password. + +You can choose to have the operating system store either the full TPM owner authorization value, the TPM administrative delegation blob plus the TPM user delegation blob, or none. + +If you enable this policy setting, Windows stores the TPM owner authorization in the registry of the local computer according to the operating system managed TPM authentication setting you choose. + +Choose the operating system managed TPM authentication setting of "Full" to store the full TPM owner authorization, the TPM administrative delegation blob and the TPM user delegation blob in the local registry. This setting allows use of the TPM without requiring remote or external storage of the TPM owner authorization value. This setting is appropriate for scenarios, which don't depend on preventing reset of the TPM anti-hammering logic or changing the TPM owner authorization value. Some TPM-based applications may require this setting be changed before features, which depend on the TPM anti-hammering logic can be used. + +Choose the operating system managed TPM authentication setting of "Delegated" to store only the TPM administrative delegation blob and the TPM user delegation blob in the local registry. This setting is appropriate for use with TPM-based applications that depend on the TPM anti-hammering logic. + +Choose the operating system managed TPM authentication setting of "None" for compatibility with previous operating systems and applications or for use with scenarios that require TPM owner authorization not be stored locally. Using this setting might cause issues with some TPM-based applications. + +> [!NOTE] +> If the operating system managed TPM authentication setting is changed from "Full" to "Delegated", the full TPM owner authorization value is regenerated and any copies of the original TPM owner authorization value are invalidated. ## Configure the level of TPM owner authorization information available to the operating system @@ -24,11 +63,11 @@ This policy setting configured which TPM authorization values are stored in the There are three TPM owner authentication settings that are managed by the Windows operating system. You can choose a value of **Full**, **Delegate**, or **None**. -- **Full**: This setting stores the full TPM owner authorization, the TPM administrative delegation blob, and the TPM user delegation blob in the local registry. With this setting, you can use the TPM without requiring remote or external storage of the TPM owner authorization value. This setting is appropriate for scenarios that do not require you to reset the TPM anti-hammering logic or change the TPM owner authorization value. Some TPM-based applications may require that this setting is changed before features that depend on the TPM anti-hammering logic can be used. Full owner authorization in TPM 1.2 is similar to lockout authorization in TPM 2.0. Owner authorization has a different meaning for TPM 2.0. +- **Full**: This setting stores the full TPM owner authorization, the TPM administrative delegation blob, and the TPM user delegation blob in the local registry. With this setting, you can use the TPM without requiring remote or external storage of the TPM owner authorization value. This setting is appropriate for scenarios that don't require you to reset the TPM anti-hammering logic or change the TPM owner authorization value. Some TPM-based applications may require that this setting is changed before features that depend on the TPM anti-hammering logic can be used. Full owner authorization in TPM 1.2 is similar to lockout authorization in TPM 2.0. Owner authorization has a different meaning for TPM 2.0. - **Delegated**: This setting stores only the TPM administrative delegation blob and the TPM user delegation blob in the local registry. This setting is appropriate for use with TPM-based applications that depend on the TPM antihammering logic. This is the default setting in Windows prior to version 1703. -- **None**: This setting provides compatibility with previous operating systems and applications. You can also use it for scenarios when TPM owner authorization cannot be stored locally. Using this setting might cause issues with some TPM-based applications. +- **None**: This setting provides compatibility with previous operating systems and applications. You can also use it for scenarios when TPM owner authorization can't be stored locally. Using this setting might cause issues with some TPM-based applications. > [!NOTE] > If the operating system managed TPM authentication setting is changed from **Full** to **Delegated**, the full TPM owner authorization value will be regenerated, and any copies of the previously set TPM owner authorization value will be invalid. @@ -46,31 +85,31 @@ The following table shows the TPM owner authorization values in the registry. | 2 | Delegated | | 4 | Full | -If you enable this policy setting, the Windows operating system will store the TPM owner authorization in the registry of the local computer according to the TPM authentication setting you choose. +If you enable this policy setting, the Windows operating system stores the TPM owner authorization in the registry of the local computer according to the TPM authentication setting you choose. -On Windows 10 prior to version 1607, if you disable or do not configure this policy setting, and the **Turn on TPM backup to Active Directory Domain Services** policy setting is also disabled or not configured, the default setting is to store the full TPM authorization value in the local registry. If this policy is disabled or not configured, and the **Turn on TPM backup to Active Directory Domain Services** policy setting is enabled, only the administrative delegation and the user delegation blobs are stored in the local registry. +On Windows 10 prior to version 1607, if you disable or don't configure this policy setting, and the **Turn on TPM backup to Active Directory Domain Services** policy setting is also disabled or not configured, the default setting is to store the full TPM authorization value in the local registry. If this policy is disabled or not configured, and the **Turn on TPM backup to Active Directory Domain Services** policy setting is enabled, only the administrative delegation and the user delegation blobs are stored in the local registry. ## Standard User Lockout Duration This policy setting allows you to manage the duration in minutes for counting standard user authorization failures for Trusted Platform Module (TPM) commands requiring authorization. An authorization failure occurs each time a standard user sends a command to the TPM and receives an error response that indicates an authorization failure occurred. Authorization failures that are older than the duration you set are ignored. If the number of TPM commands with an authorization failure within the lockout duration equals a threshold, a standard user is prevented from sending commands that require authorization to the TPM. -The TPM is designed to protect itself against password guessing attacks by entering a hardware lockout mode when it receives too many commands with an incorrect authorization value. When the TPM enters a lockout mode, it is global for all users (including administrators) and for Windows features such as BitLocker Drive Encryption. +The TPM is designed to protect itself against password guessing attacks by entering a hardware lockout mode when it receives too many commands with an incorrect authorization value. When the TPM enters a lockout mode, it's global for all users (including administrators) and for Windows features such as BitLocker Drive Encryption. This setting helps administrators prevent the TPM hardware from entering a lockout mode by slowing the speed at which standard users can send commands that require authorization to the TPM. For each standard user, two thresholds apply. Exceeding either threshold prevents the user from sending a command that requires authorization to the TPM. Use the following policy settings to set the lockout duration: -- [Standard User Individual Lockout Threshold](#standard-user-individual-lockout-threshold): This value is the maximum number of authorization failures that each standard user can have before the user is not allowed to send commands that require authorization to the TPM. -- [Standard User Total Lockout Threshold](#standard-user-total-lockout-threshold): This value is the maximum total number of authorization failures that all standard users can have before all standard users are not allowed to send commands that require authorization to the TPM. +- [Standard User Individual Lockout Threshold](#standard-user-individual-lockout-threshold): This value is the maximum number of authorization failures that each standard user can have before the user isn't allowed to send commands that require authorization to the TPM. +- [Standard User Total Lockout Threshold](#standard-user-total-lockout-threshold): This value is the maximum total number of authorization failures that all standard users can have before all standard users aren't allowed to send commands that require authorization to the TPM. An administrator with the TPM owner password can fully reset the TPM's hardware lockout logic by using the Windows Defender Security Center. Each time an administrator resets the TPM's hardware lockout logic, all prior standard user TPM authorization failures are ignored. This allows standard users to immediately use the TPM normally. -If you do not configure this policy setting, a default value of 480 minutes (8 hours) is used. +If you don't configure this policy setting, a default value of 480 minutes (8 hours) is used. ## Standard User Individual Lockout Threshold -This policy setting allows you to manage the maximum number of authorization failures for each standard user for the Trusted Platform Module (TPM). This value is the maximum number of authorization failures that each standard user can have before the user is not allowed to send commands that require authorization to the TPM. If the number of authorization failures for the user within the duration that is set for the **Standard User Lockout Duration** policy setting equals this value, the standard user is prevented from sending commands that require authorization to the Trusted Platform Module (TPM). +This policy setting allows you to manage the maximum number of authorization failures for each standard user for the Trusted Platform Module (TPM). This value is the maximum number of authorization failures that each standard user can have before the user isn't allowed to send commands that require authorization to the TPM. If the number of authorization failures for the user within the duration that is set for the **Standard User Lockout Duration** policy setting equals this value, the standard user is prevented from sending commands that require authorization to the Trusted Platform Module (TPM). This setting helps administrators prevent the TPM hardware from entering a lockout mode by slowing the speed at which standard users can send commands that require authorization to the TPM. @@ -78,7 +117,7 @@ An authorization failure occurs each time a standard user sends a command to the An administrator with the TPM owner password can fully reset the TPM's hardware lockout logic by using the Windows Defender Security Center. Each time an administrator resets the TPM's hardware lockout logic, all prior standard user TPM authorization failures are ignored. This allows standard users to immediately use the TPM normally. -If you do not configure this policy setting, a default value of 4 is used. A value of zero means that the operating system will not allow standard users to send commands to the TPM, which might cause an authorization failure. +If you don't configure this policy setting, a default value of 4 is used. A value of zero means that the operating system won't allow standard users to send commands to the TPM, which might cause an authorization failure. ## Standard User Total Lockout Threshold @@ -90,7 +129,7 @@ An authorization failure occurs each time a standard user sends a command to the An administrator with the TPM owner password can fully reset the TPM's hardware lockout logic by using the Windows Defender Security Center. Each time an administrator resets the TPM's hardware lockout logic, all prior standard user TPM authorization failures are ignored. This allows standard users to immediately use the TPM normally. -If you do not configure this policy setting, a default value of 9 is used. A value of zero means that the operating system will not allow standard users to send commands to the TPM, which might cause an authorization failure. +If you don't configure this policy setting, a default value of 9 is used. A value of zero means that the operating system won't allow standard users to send commands to the TPM, which might cause an authorization failure. ## Configure the system to use legacy Dictionary Attack Prevention Parameters setting for TPM 2.0 @@ -114,14 +153,13 @@ You can change what users see about TPM in **Windows Security**. The Group Polic ### Disable the Clear TPM button -If you don't want users to be able to click the **Clear TPM** button in **Windows Security**, you can disable it with this Group Policy setting. Select **Enabled** to make the **Clear TPM** button unavailable for use. +If you don't want users to be able to select the **Clear TPM** button in **Windows Security**, you can disable it with this Group Policy setting. Select **Enabled** to make the **Clear TPM** button unavailable for use. ### Hide the TPM Firmware Update recommendation If you don't want users to see the recommendation to update TPM firmware, you can disable it with this setting. Select **Enabled** to prevent users from seeing a recommendation to update their TPM firmware when a vulnerable firmware is detected. -## Related topics +## Related articles -- [Trusted Platform Module](trusted-platform-module-overview.md) - [TPM Cmdlets in Windows PowerShell](/powershell/module/trustedplatformmodule/?view=win10-ps&preserve-view=true) - [BitLocker planning guide](../../operating-system-security/data-protection/bitlocker/planning-guide.md) From a5f03be45bc2b90f1ef309c6c8a47351d2a6cbc1 Mon Sep 17 00:00:00 2001 From: "Vinay Pamnani (from Dev Box)" Date: Wed, 10 Jul 2024 16:47:47 -0600 Subject: [PATCH 29/41] OS Security freshness --- .../block-untrusted-fonts-in-enterprise.md | 12 +- ...tions-for-app-related-security-policies.md | 26 +-- ...arding-to-assist-in-intrusion-detection.md | 150 +++++++++--------- .../get-support-for-security-baselines.md | 2 +- .../mbsa-removal-and-guidance.md | 4 +- .../security-compliance-toolkit-10.md | 2 +- .../windows-security-baselines.md | 4 +- .../operating-system-security/index.md | 2 +- .../cryptography-certificate-mgmt.md | 4 +- ...-the-health-of-windows-10-based-devices.md | 68 ++++---- .../secure-the-windows-10-boot-process.md | 8 +- .../system-security/trusted-boot.md | 8 +- .../available-settings.md | 58 +++---- .../enhanced-phishing-protection.md | 6 +- .../microsoft-defender-smartscreen/index.md | 2 +- 15 files changed, 175 insertions(+), 181 deletions(-) diff --git a/windows/security/operating-system-security/device-management/block-untrusted-fonts-in-enterprise.md b/windows/security/operating-system-security/device-management/block-untrusted-fonts-in-enterprise.md index 75a3f08635..fc6df9c4a9 100644 --- a/windows/security/operating-system-security/device-management/block-untrusted-fonts-in-enterprise.md +++ b/windows/security/operating-system-security/device-management/block-untrusted-fonts-in-enterprise.md @@ -3,12 +3,12 @@ title: Block untrusted fonts in an enterprise description: To help protect your company from attacks that may originate from untrusted or attacker controlled font files, we've created the Blocking Untrusted Fonts feature. ms.localizationpriority: medium ms.topic: how-to -ms.date: 12/22/2023 +ms.date: 07/10/2024 --- # Block untrusted fonts in an enterprise -To help protect your company from attacks that may originate from untrusted or attacker-controlled font files, we've created the Blocking Untrusted Fonts feature. Using this feature, you can turn on a global setting that stops your employees from loading untrusted fonts processed using the Graphics Device Interface (GDI) onto your network. Untrusted fonts are any font installed outside of the `%windir%\Fonts` directory. Blocking untrusted fonts helps prevent both remote (web-based or email-based) and local EOP attacks that can happen during the font file-parsing process. +To help protect your company from attacks that may originate from untrusted or attacker-controlled font files, you can block untrusted fonts. Using this feature, you can turn on a global setting that stops your employees from loading untrusted fonts processed using the Graphics Device Interface (GDI) onto your network. Untrusted fonts are any font installed outside of the `%windir%\Fonts` directory. Blocking untrusted fonts helps prevent both remote (web-based or email-based) and local EOP attacks that can happen during the font file-parsing process. ## What does this mean for me? @@ -44,11 +44,11 @@ Use Group Policy or the registry to turn this feature on, off, or to use audit m **To turn on and use the Blocking Untrusted Fonts feature through Group Policy** 1. Open the Group Policy editor (gpedit.msc) and go to `Computer Configuration\Administrative Templates\System\Mitigation Options\Untrusted Font Blocking`. -2. Click **Enabled** to turn on the feature, and then click one of the following **Mitigation Options**: +2. Select **Enabled** to turn on the feature, and then select one of the following **Mitigation Options**: - **Block untrusted fonts and log events.** Turns on the feature, blocking untrusted fonts and logging installation attempts to the event log. - **Do not block untrusted fonts.** Turns on the feature, but doesn't block untrusted fonts nor does it log installation attempts to the event log. - **Log events without blocking untrusted fonts**. Turns on the feature, logging installation attempts to the event log, but not blocking untrusted fonts. -3. Click **OK**. +3. Select **OK**. **To turn on and use the Blocking Untrusted Fonts feature through the registry** @@ -56,7 +56,7 @@ To turn this feature on, off, or to use audit mode: 1. Open the registry editor (regedit.exe) and go to `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel\`. 2. If the **MitigationOptions** key isn't there, right-click and add a new **QWORD (64-bit) Value**, renaming it to **MitigationOptions**. -3. Right click on the **MitigationOptions** key, and then click **Modify**. The **Edit QWORD (64-bit) Value** box opens. +3. Right select on the **MitigationOptions** key, and then select **Modify**. The **Edit QWORD (64-bit) Value** box opens. 4. Make sure the **Base** option is **Hexadecimal**, and then update the **Value data**, making sure you keep your existing value, like in the important note below: - **To turn this feature on.** Type **1000000000000**. - **To turn this feature off.** Type **2000000000000**. @@ -114,7 +114,7 @@ After you figure out the problematic fonts, you can try to fix your apps in two **To fix your apps by installing the problematic fonts (recommended)** -On each computer with the app installed, right-click on the font name and click **Install**. The font should automatically install into your `%windir%\Fonts` directory. If it doesn't, you'll need to manually copy the font files into the **Fonts** directory and run the installation from there. +On each computer with the app installed, right-click on the font name and select **Install**. The font should automatically install into your `%windir%\Fonts` directory. If it doesn't, you need to manually copy the font files into the **Fonts** directory and run the installation from there. **To fix your apps by excluding processes** diff --git a/windows/security/operating-system-security/device-management/override-mitigation-options-for-app-related-security-policies.md b/windows/security/operating-system-security/device-management/override-mitigation-options-for-app-related-security-policies.md index ada9f32a4e..6ebc5f4369 100644 --- a/windows/security/operating-system-security/device-management/override-mitigation-options-for-app-related-security-policies.md +++ b/windows/security/operating-system-security/device-management/override-mitigation-options-for-app-related-security-policies.md @@ -3,7 +3,7 @@ title: Override Process Mitigation Options description: How to use Group Policy to override individual Process Mitigation Options settings and to help enforce specific app-related security policies. ms.localizationpriority: medium ms.topic: how-to -ms.date: 12/22/2023 +ms.date: 07/10/2024 --- # Override Process Mitigation Options to help enforce app-related security policies @@ -13,10 +13,10 @@ Windows includes group policy-configurable "Process Mitigation Options" that add > [!IMPORTANT] > We recommend trying these mitigations in a test lab before deploying to your organization, to determine if they interfere with your organization's required apps. -The Group Policy settings in this topic are related to three types of process mitigations. All three types are on by default for 64-bit applications, but by using the Group Policy settings described in this topic, you can configure more protections. The types of process mitigations are: +The Group Policy settings in this article are related to three types of process mitigations. All three types are on by default for 64-bit applications, but by using the Group Policy settings described in this article, you can configure more protections. The types of process mitigations are: -- **Data Execution Prevention (DEP)** is a system-level memory protection feature that enables the operating system to mark one or more pages of memory as non-executable, preventing code from being run from that region of memory, to help prevent exploitation of buffer overruns. DEP helps prevent code from being run from data pages such as the default heap, stacks, and memory pools. For more information, see [Data Execution Prevention](../../threat-protection/overview-of-threat-mitigations-in-windows-10.md#data-execution-prevention). -- **Structured Exception Handling Overwrite Protection (SEHOP)** is designed to block exploits that use the Structured Exception Handler (SEH) overwrite technique. Because this protection mechanism is provided at run-time, it helps to protect apps regardless of whether they've been compiled with the latest improvements. For more information, see [Structured Exception Handling Overwrite Protection](../../threat-protection/overview-of-threat-mitigations-in-windows-10.md#structured-exception-handling-overwrite-protection). +- **Data Execution Prevention (DEP)** is a system-level memory protection feature that enables the operating system to mark one or more pages of memory as nonexecutable, preventing code from being run from that region of memory, to help prevent exploitation of buffer overruns. DEP helps prevent code from being run from data pages such as the default heap, stacks, and memory pools. For more information, see [Data Execution Prevention](../../threat-protection/overview-of-threat-mitigations-in-windows-10.md#data-execution-prevention). +- **Structured Exception Handling Overwrite Protection (SEHOP)** is designed to block exploits that use the Structured Exception Handler (SEH) overwrite technique. Because this protection mechanism is provided at run-time, it helps to protect apps regardless of whether they're compiled with the latest improvements. For more information, see [Structured Exception Handling Overwrite Protection](../../threat-protection/overview-of-threat-mitigations-in-windows-10.md#structured-exception-handling-overwrite-protection). - **Address Space Layout Randomization (ASLR)** loads DLLs into random memory addresses at boot time to mitigate against malware that's designed to attack specific memory locations, where specific DLLs are expected to be loaded. For more information, see [Address Space Layout Randomization](../../threat-protection/overview-of-threat-mitigations-in-windows-10.md#address-space-layout-randomization). To find more ASLR protections in the table below, look for `IMAGES` or `ASLR`. The following procedure describes how to use Group Policy to override individual **Process Mitigation Options** settings. @@ -27,7 +27,7 @@ The following procedure describes how to use Group Policy to override individual ![Screenshot of the Group Policy editor: Process Mitigation Options with setting enabled and Show button active.](images/gp-process-mitigation-options.png) -2. Click **Enabled**, and then in the **Options** area, click **Show** to open the **Show Contents** box, where you'll be able to add your apps and the appropriate bit flag values, as shown in the [Setting the bit field](#setting-the-bit-field) and [Example](#example) sections of this topic. +2. Select **Enabled**, and then in the **Options** area, select **Show** to open the **Show Contents** box, where you can add your apps and the appropriate bit flag values, as shown in the [Setting the bit field](#setting-the-bit-field) and [Example](#example) sections of this article. > [!IMPORTANT] > For each app you want to include, you must include: @@ -45,14 +45,14 @@ Here's a visual representation of the bit flag locations for the various Process Where the bit flags are read from right to left and are defined as: -| Flag | Bit location | Setting | Details | -|------|--------------|-----------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| A | 0 | `PROCESS_CREATION_MITIGATION_POLICY_DEP_ENABLE (0x00000001)` | Turns on Data Execution Prevention (DEP) for child processes. | -| B | 1 | `PROCESS_CREATION_MITIGATION_POLICY_DEP_ATL_THUNK_ENABLE (0x00000002)` | Turns on DEP-ATL thunk emulation for child processes. DEP-ATL thunk emulation lets the system intercept non-executable (NX) faults that originate from the Active Template Library (ATL) thunk layer, and then emulate and handle the instructions so the process can continue to run. | -| C | 2 | `PROCESS_CREATION_MITIGATION_POLICY_SEHOP_ENABLE (0x00000004)` | Turns on Structured Exception Handler Overwrite Protection (SEHOP) for child processes. SEHOP helps to block exploits that use the Structured Exception Handler (SEH) overwrite technique. | -| D | 8 | `PROCESS_CREATION_MITIGATION_POLICY_FORCE_RELOCATE_IMAGES_ALWAYS_ON (0x00000100)` | Uses the force Address Space Layout Randomization (ASLR) setting to act as though an image base collision happened at load time, forcibly rebasing images that aren't dynamic base compatible. Images without the base relocation section won't be loaded if relocations are required. | -| E | 15 | `PROCESS_CREATION_MITIGATION_POLICY_BOTTOM_UP_ASLR_ALWAYS_ON (0x00010000)` | Turns on the bottom-up randomization policy, which includes stack randomization options and causes a random location to be used as the lowest user address. | -| F | 16 | `PROCESS_CREATION_MITIGATION_POLICY_BOTTOM_UP_ASLR_ALWAYS_OFF (0x00020000)` | Turns off the bottom-up randomization policy, which includes stack randomization options and causes a random location to be used as the lowest user address. | +| Flag | Bit location | Setting | Details | +|--|--|--|--| +| A | 0 | `PROCESS_CREATION_MITIGATION_POLICY_DEP_ENABLE (0x00000001)` | Turns on Data Execution Prevention (DEP) for child processes. | +| B | 1 | `PROCESS_CREATION_MITIGATION_POLICY_DEP_ATL_THUNK_ENABLE (0x00000002)` | Turns on DEP-ATL thunk emulation for child processes. DEP-ATL thunk emulation lets the system intercept nonexecutable (NX) faults that originate from the Active Template Library (ATL) thunk layer, and then emulate and handle the instructions so the process can continue to run. | +| C | 2 | `PROCESS_CREATION_MITIGATION_POLICY_SEHOP_ENABLE (0x00000004)` | Turns on Structured Exception Handler Overwrite Protection (SEHOP) for child processes. SEHOP helps to block exploits that use the Structured Exception Handler (SEH) overwrite technique. | +| D | 8 | `PROCESS_CREATION_MITIGATION_POLICY_FORCE_RELOCATE_IMAGES_ALWAYS_ON (0x00000100)` | Uses the force Address Space Layout Randomization (ASLR) setting to act as though an image base collision happened at load time, forcibly rebasing images that aren't dynamic base compatible. Images without the base relocation section aren't loaded if relocations are required. | +| E | 15 | `PROCESS_CREATION_MITIGATION_POLICY_BOTTOM_UP_ASLR_ALWAYS_ON (0x00010000)` | Turns on the bottom-up randomization policy, which includes stack randomization options and causes a random location to be used as the lowest user address. | +| F | 16 | `PROCESS_CREATION_MITIGATION_POLICY_BOTTOM_UP_ASLR_ALWAYS_OFF (0x00020000)` | Turns off the bottom-up randomization policy, which includes stack randomization options and causes a random location to be used as the lowest user address. | ### Example diff --git a/windows/security/operating-system-security/device-management/use-windows-event-forwarding-to-assist-in-intrusion-detection.md b/windows/security/operating-system-security/device-management/use-windows-event-forwarding-to-assist-in-intrusion-detection.md index 100c5b8c1f..370ae5677a 100644 --- a/windows/security/operating-system-security/device-management/use-windows-event-forwarding-to-assist-in-intrusion-detection.md +++ b/windows/security/operating-system-security/device-management/use-windows-event-forwarding-to-assist-in-intrusion-detection.md @@ -3,14 +3,14 @@ title: Use Windows Event Forwarding to help with intrusion detection description: Learn about an approach to collect events from devices in your organization. This article talks about events in both normal operations and when an intrusion is suspected. ms.localizationpriority: medium ms.topic: how-to -ms.date: 12/22/2023 +ms.date: 07/10/2024 --- # Use Windows Event Forwarding to help with intrusion detection Learn about an approach to collect events from devices in your organization. This article talks about events in both normal operations and when an intrusion is suspected. -Windows Event Forwarding (WEF) reads any operational or administrative event log on a device in your organization and forwards the events you choose to a Windows Event Collector (WEC) server. +Windows Event Forwarding (WEF) reads any operational or administrative event logged on a device in your organization and forwards the events you choose to a Windows Event Collector (WEC) server. To accomplish this functionality, there are two different subscriptions published to client devices - the Baseline subscription and the suspect subscription. The Baseline subscription enrolls all devices in your organization, and a Suspect subscription only includes devices that have been added by you. The Suspect subscription collects more events to help build context for system activity and can quickly be updated to accommodate new events and/or scenarios as needed without impacting baseline operations. @@ -35,12 +35,12 @@ For the minimum recommended audit policy and registry system ACL settings, see [ > [!NOTE] > These are only minimum values need to meet what the WEF subscription selects. -From a WEF subscription management perspective, the event queries provided should be used in two separate subscriptions for ease of maintenance; only machines meeting specific criteria would be allowed access to the targeted subscription, this access would be determined by an algorithm or an analysts' direction. All devices should have access to the Baseline subscription. +From a WEF subscription management perspective, the event queries provided should be used in two separate subscriptions for ease of maintenance; only machines meeting specific criteria would be allowed access to the targeted subscription. This access would be determined by an algorithm or an analysts' direction. All devices should have access to the Baseline subscription. This system of dual subscription means you would create two base subscriptions: -- **Baseline WEF subscription**. Events collected from all hosts; these events include some role-specific events, which will only be emitted by those machines. -- **Targeted WEF subscription**. Events collected from a limited set of hosts due to unusual activity and/or heightened awareness for those systems. +- **Baseline WEF subscription**. Events collected from all hosts; these events include some role-specific events, which will only be emitted by those machines. +- **Targeted WEF subscription**. Events collected from a limited set of hosts due to unusual activity and/or heightened awareness for those systems. Each using the respective event query below. For the Targeted subscription, enabling the "read existing events" option should be set to true to allow collection of existing events from systems. By default, WEF subscriptions will only forward events generated after the WEF subscription was received by the client. @@ -58,7 +58,7 @@ The longer answer is: The **Eventlog-forwardingPlugin/Operational** event channe ### Is WEF Push or Pull? -A WEF subscription can be configured to be pushed or pulled, but not both. The simplest, most flexible IT deployment with the greatest scalability can be achieved by using a push, or source initiated, subscription. WEF clients are configured by using a GPO and the built-in forwarding client is activated. For pull, collector initiated, the subscription on the WEC server is pre-configured with the names of the WEF Client devices from which events are to be selected. Those clients are to be configured ahead of time to allow the credentials used in the subscription to access their event logs remotely (normally by adding the credential to the **Event Log Readers** built-in local security group.) A useful scenario: closely monitoring a specific set of machines. +A WEF subscription can be configured to be pushed or pulled, but not both. The simplest, most flexible IT deployment with the greatest scalability can be achieved by using a push, or source initiated, subscription. WEF clients are configured by using a GPO and the built-in forwarding client is activated. For pull, collector initiated, the subscription on the WEC server is preconfigured with the names of the WEF Client devices from which events are to be selected. Those clients are to be configured ahead of time to allow the credentials used in the subscription to access their event logs remotely (normally by adding the credential to the **Event Log Readers** built-in local security group.) A useful scenario: closely monitoring a specific set of machines. ### Will WEF work over VPN or RAS? @@ -67,7 +67,7 @@ WEF handles VPN, RAS, and DirectAccess scenarios well and will reconnect and sen ### How is client progress tracked? The WEC server maintains in its registry the bookmark information and last heartbeat time for each event source for each WEF subscription. When an event source reconnects to a WEC server, the last bookmark position is sent to the device to use as a starting point to resume forwarding events. If a -WEF client has no events to send, the WEF client will connect periodically to send a Heartbeat to the WEC server to indicate it's active. This heartbeat value can be individually configured for each subscription. +WEF client has no events to send, the WEF client connects periodically to send a Heartbeat to the WEC server to indicate it's active. This heartbeat value can be individually configured for each subscription. ### Will WEF work in an IPv4, IPv6, or mixed IPv4/IPv6 environment? @@ -130,19 +130,19 @@ For collector initiated subscriptions: The subscription contains the list of mac ### Can a client communicate to multiple WEF Event Collectors? -Yes. If you desire a High-Availability environment, configure multiple WEC servers with the same subscription configuration and publish both WEC Server URIs to WEF clients. WEF Clients will forward events simultaneously to the configured subscriptions on the WEC servers, if they have the appropriate access. +Yes. If you desire a High-Availability environment, configure multiple WEC servers with the same subscription configuration and publish both WEC Server URIs to WEF clients. WEF Clients forward events simultaneously to the configured subscriptions on the WEC servers, if they have the appropriate access. ### What are the WEC server's limitations? There are three factors that limit the scalability of WEC servers. The general rule for a stable WEC server on commodity hardware is planning for a total of 3,000 events per second on average for all configured subscriptions. -- **Disk I/O**. The WEC server doesn't process or validate the received event, but rather buffers the received event and then logs it to a local event log file (EVTX file). The speed of logging to the EVTX file is limited by the disk write speed. Isolating the EVTX file to its own array or using high speed disks can increase the number of events per second that a single WEC server can receive. -- **Network Connections**. While a WEF source doesn't maintain a permanent, persistent connection to the WEC server, it doesn't immediately disconnect after sending its events. This leniency means that the number of WEF sources that can simultaneously connect to the WEC server is limited to the open TCP ports available on the WEC server. -- **Registry size**. For each unique device that connects to a WEF subscription, there's a registry key (corresponding to the FQDN of the WEF Client) created to store bookmark and source heartbeat information. If this information isn't pruned to remove inactive clients, this set of registry keys can grow to an unmanageable size over time. +- **Disk I/O**. The WEC server doesn't process or validate the received event, but rather buffers the received event and then logs it to a local event log file (EVTX file). The speed of logging to the EVTX file is limited by the disk write speed. Isolating the EVTX file to its own array or using high speed disks can increase the number of events per second that a single WEC server can receive. +- **Network Connections**. While a WEF source doesn't maintain a permanent, persistent connection to the WEC server, it doesn't immediately disconnect after sending its events. This leniency means that the number of WEF sources that can simultaneously connect to the WEC server is limited to the open TCP ports available on the WEC server. +- **Registry size**. For each unique device that connects to a WEF subscription, there's a registry key (corresponding to the FQDN of the WEF Client) created to store bookmark and source heartbeat information. If this information isn't pruned to remove inactive clients, this set of registry keys can grow to an unmanageable size over time. - - When a subscription has >1000 WEF sources connect to it over its operational lifetime, also known as lifetime WEF sources, Event Viewer can become unresponsive for a few minutes when selecting the **Subscriptions** node in the left-navigation, but will function normally afterwards. - - At >50,000 lifetime WEF sources, Event Viewer is no longer an option and wecutil.exe (included with Windows) must be used to configure and manage subscriptions. - - At >100,000 lifetime WEF sources, the registry won't be readable and the WEC server will likely have to be rebuilt. + - When a subscription has >1000 WEF sources connect to it over its operational lifetime, also known as lifetime WEF sources, Event Viewer can become unresponsive for a few minutes when selecting the **Subscriptions** node in the left-navigation, but will function normally afterwards. + - At >50,000 lifetime WEF sources, Event Viewer is no longer an option and wecutil.exe (included with Windows) must be used to configure and manage subscriptions. + - At >100,000 lifetime WEF sources, the registry won't be readable and the WEC server will likely have to be rebuilt. ## Subscription information @@ -158,56 +158,56 @@ The subscription is essentially a collection of query statements applied to the To gain the most value out of the baseline subscription, we recommend having the following requirements set on the device to ensure that the clients are already generating the required events to be forwarded off the system. -- Apply a security audit policy that is a super-set of the recommended minimum audit policy. For more info, see [Appendix A - Minimum Recommended minimum Audit Policy](#bkmk-appendixa). This policy ensures that the security event log is generating the required events. -- Apply at least an Audit-Only AppLocker policy to devices. +- Apply a security audit policy that is a super-set of the recommended minimum audit policy. For more info, see [Appendix A - Minimum Recommended minimum Audit Policy](#bkmk-appendixa). This policy ensures that the security event log is generating the required events. +- Apply at least an Audit-Only AppLocker policy to devices. - - If you're already allowing or restricting events by using AppLocker, then this requirement is met. - - AppLocker events contain useful information, such as file hash and digital signature information for executables and scripts. + - If you're already allowing or restricting events by using AppLocker, then this requirement is met. + - AppLocker events contain useful information, such as file hash and digital signature information for executables and scripts. -- Enable disabled event channels and set the minimum size for modern event files. -- Currently, there's no GPO template for enabling or setting the maximum size for the modern event files. This threshold must be defined by using a GPO. For more info, see [Appendix C - Event Channel Settings (enable and Channel Access) methods](#bkmk-appendixc). +- Enable disabled event channels and set the minimum size for modern event files. +- Currently, there's no GPO template for enabling or setting the maximum size for the modern event files. This threshold must be defined by using a GPO. For more info, see [Appendix C - Event Channel Settings (enable and Channel Access) methods](#bkmk-appendixc). The annotated event query can be found in the following. For more info, see [Appendix F - Annotated Suspect Subscription Event Query](#bkmk-appendixf). -- Anti-malware events from Microsoft Antimalware or Windows Defender. These events can be configured for any given anti-malware product easily if it writes to the Windows event log. +- Anti-malware events from Windows Security. These events can be configured for any given anti-malware product easily if it writes to the Windows event log. - Security event log Process Create events. - AppLocker Process Create events (EXE, script, packaged App installation and execution). - Registry modification events. For more info, see [Appendix B - Recommended minimum Registry System ACL Policy](#bkmk-appendixb). - OS startup and shutdown - - Startup events include operating system version, service pack level, QFE version, and boot mode. + - Startup events include operating system version, service pack level, QFE version, and boot mode. - Service install - - Includes what the name of the service, the image path, and who installed the service. + - Includes what the name of the service, the image path, and who installed the service. - Certificate Authority audit events - - These events are only applicable on systems with the Certificate Authority role installed. - - Logs certificate requests and responses. + - These events are only applicable on systems with the Certificate Authority role installed. + - Logs certificate requests and responses. - User profile events - - Use of a temporary profile or unable to create a user profile may indicate an intruder is interactively logging into a device but not wanting to leave a persistent profile behind. + - Use of a temporary profile or unable to create a user profile may indicate an intruder is interactively logging into a device but not wanting to leave a persistent profile behind. - Service start failure - - Failure codes are localized, so you have to check the message DLL for values. + - Failure codes are localized, so you have to check the message DLL for values. - Network share access events - - Filter out IPC$ and /NetLogon file shares, which are expected and noisy. + - Filter out IPC$ and /NetLogon file shares, which are expected and noisy. - System shutdown initiate requests - - Find out what initiated the restart of a device. + - Find out what initiated the restart of a device. -- User-initiated interactive sign-out event +- User-initiated interactive sign out event - Remote Desktop Services sessions connect, reconnect, or disconnect. - EMET events, if EMET is installed. - Event forwarding plugin events - - For monitoring WEF subscription operations, such as Partial Success events. This event is useful for diagnosing deployment issues. + - For monitoring WEF subscription operations, such as Partial Success events. This event is useful for diagnosing deployment issues. - Network share creation and deletion @@ -217,111 +217,111 @@ The annotated event query can be found in the following. For more info, see [App - Sign-in sessions - - Sign-in success for interactive (local and Remote Interactive/Remote Desktop) - - Sign-in success for services for non-built-in accounts, such as LocalSystem, LocalNetwork, and so on. - - Sign-in success for batch sessions - - Sign-in session close, which is sign-out events for non-network sessions. + - Sign-in success for interactive (local and Remote Interactive/Remote Desktop) + - Sign-in success for services for non-built-in accounts, such as LocalSystem, LocalNetwork, and so on. + - Sign-in success for batch sessions + - Sign-in session close, which is sign out events for non-network sessions. - Windows Error Reporting (Application crash events only) - - This session can help detect early signs of intruder not familiar with enterprise environment using targeted malware. + - This session can help detect early signs of intruder not familiar with enterprise environment using targeted malware. - Event log service events - - Errors, start events, and stop events for the Windows Event Log service. + - Errors, start events, and stop events for the Windows Event Log service. - Event log cleared (including the Security Event Log) - - This event could indicate an intruder that is covering their tracks. + - This event could indicate an intruder that is covering their tracks. - Special privileges assigned to new sign in - - This assignation indicates that at the time of signing in, a user is either an Administrator or has the sufficient access to make themselves Administrator. + - This assignation indicates that at the time of signing in, a user is either an Administrator or has the sufficient access to make themselves Administrator. - Outbound Remote Desktop Services session attempts - - Visibility into potential beachhead for intruder + - Visibility into potential beachhead for intruder - System time changed - SMB Client (mapped drive connections) - Account credential validation - - Local accounts or domain accounts on domain controllers + - Local accounts or domain accounts on domain controllers - A user was added or removed from the local Administrators security group. - Crypto API private key accessed - - Associated with signing objects using the locally stored private key. + - Associated with signing objects using the locally stored private key. - Task Scheduler task creation and delete - - Task Scheduler allows intruders to run code at specified times as LocalSystem. + - Task Scheduler allows intruders to run code at specified times as LocalSystem. - Sign-in with explicit credentials - - Detect credential use changes by intruders to access more resources. + - Detect credential use changes by intruders to access more resources. - Smartcard card holder verification events - - This event detects when a smartcard is being used. + - This event detects when a smartcard is being used. ### Suspect subscription This subscription adds some possible intruder-related activity to help analyst further refine their determinations about the state of the device. -- Sign-in session creation for network sessions +- Sign-in session creation for network sessions - - Enables time-series analysis of network graphs. + - Enables time-series analysis of network graphs. -- RADIUS and VPN events +- RADIUS and VPN events - - Useful if you use a Microsoft IAS RADIUS/VPN implementation. It shows user-> IP address assignment with remote IP address connecting to the enterprise. + - Useful if you use a Microsoft IAS RADIUS/VPN implementation. It shows user-> IP address assignment with remote IP address connecting to the enterprise. -- Crypto API X509 object and build chain events +- Crypto API X509 object and build chain events - - Detects known bad certificate, CA, or sub-CA - - Detects unusual process use of CAPI + - Detects known bad certificate, CA, or sub-CA + - Detects unusual process use of CAPI -- Groups assigned to local sign in +- Groups assigned to local sign in - - Gives visibility to groups that enable account-wide access - - Allows better planning for remediation efforts - - Excludes well known, built-in system accounts. + - Gives visibility to groups that enable account-wide access + - Allows better planning for remediation efforts + - Excludes well known, built-in system accounts. -- Sign-in session exit +- Sign-in session exit - - Specific for network sign-in sessions. + - Specific for network sign-in sessions. -- Client DNS lookup events +- Client DNS lookup events - - Returns what process performed a DNS query and the results returned from the DNS server. + - Returns what process performed a DNS query and the results returned from the DNS server. -- Process exit +- Process exit - - Enables checking for processes terminating unexpectedly. + - Enables checking for processes terminating unexpectedly. -- Local credential validation or signing in with explicit credentials +- Local credential validation or signing in with explicit credentials - - Generated when the local SAM is authoritative for the account credentials being authenticated. - - Noisy on domain controllers - - On client devices, it's only generated when local accounts sign in. + - Generated when the local SAM is authoritative for the account credentials being authenticated. + - Noisy on domain controllers + - On client devices, it's only generated when local accounts sign in. -- Registry modification audit events +- Registry modification audit events - - Only when a registry value is being created, modified, or deleted. + - Only when a registry value is being created, modified, or deleted. -- Wireless 802.1x authentication +- Wireless 802.1x authentication - - Detect wireless connection with a peer MAC address + - Detect wireless connection with a peer MAC address -- Windows PowerShell logging +- Windows PowerShell logging - - Covers Windows PowerShell 2.0 and later and includes the Windows PowerShell 5.0 logging improvements for in-memory attacks using Windows PowerShell. - - Includes Windows PowerShell remoting logging + - Covers Windows PowerShell 2.0 and later and includes the Windows PowerShell 5.0 logging improvements for in-memory attacks using Windows PowerShell. + - Includes Windows PowerShell remoting logging -- User Mode Driver Framework "Driver Loaded" event +- User Mode Driver Framework "Driver Loaded" event - - Can possibly detect a USB device loading multiple device drivers. For example, a USB\_STOR device loading the keyboard or network driver. + - Can possibly detect a USB device loading multiple device drivers. For example, a USB\_STOR device loading the keyboard or network driver. ## Appendix A - Minimum recommended minimum audit policy diff --git a/windows/security/operating-system-security/device-management/windows-security-configuration-framework/get-support-for-security-baselines.md b/windows/security/operating-system-security/device-management/windows-security-configuration-framework/get-support-for-security-baselines.md index 7325710e0c..f0014cf81a 100644 --- a/windows/security/operating-system-security/device-management/windows-security-configuration-framework/get-support-for-security-baselines.md +++ b/windows/security/operating-system-security/device-management/windows-security-configuration-framework/get-support-for-security-baselines.md @@ -3,7 +3,7 @@ title: Get support for security baselines description: Find answers to frequently asked question on how to get support for baselines, the Security Compliance Toolkit (SCT), and related articles. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 10/31/2023 +ms.date: 07/10/2024 --- # Get Support diff --git a/windows/security/operating-system-security/device-management/windows-security-configuration-framework/mbsa-removal-and-guidance.md b/windows/security/operating-system-security/device-management/windows-security-configuration-framework/mbsa-removal-and-guidance.md index e68c6df87a..08bb94eda4 100644 --- a/windows/security/operating-system-security/device-management/windows-security-configuration-framework/mbsa-removal-and-guidance.md +++ b/windows/security/operating-system-security/device-management/windows-security-configuration-framework/mbsa-removal-and-guidance.md @@ -2,7 +2,7 @@ title: Guide to removing Microsoft Baseline Security Analyzer (MBSA) description: This article documents the removal of Microsoft Baseline Security Analyzer (MBSA) and provides alternative solutions. ms.localizationpriority: medium -ms.date: 07/11/2023 +ms.date: 07/10/2024 ms.topic: conceptual --- @@ -28,7 +28,7 @@ For example: [![Screenshot that shows the PowerShell script.](images/powershell-example.png)](https://www.powershellgallery.com/packages/Scan-UpdatesOffline/1.0) The preceding scripts use the [WSUS offline scan file](https://support.microsoft.com/help/927745/detailed-information-for-developers-who-use-the-windows-update-offline) (wsusscn2.cab) to perform a scan and get the same information on missing updates as MBSA supplied. MBSA also relied on the wsusscn2.cab to determine which updates were missing from a given system without connecting to any online service or server. The wsusscn2.cab file is still available and there are currently no plans to remove or replace it. -The wsusscn2.cab file contains the metadata of only security updates, update rollups and service packs available from Microsoft Update; it doesn't contain any information on non-security updates, tools or drivers. +The wsusscn2.cab file contains the metadata of only security updates, update rollups, and service packs available from Microsoft Update; it doesn't contain any information on non-security updates, tools, or drivers. ## More information diff --git a/windows/security/operating-system-security/device-management/windows-security-configuration-framework/security-compliance-toolkit-10.md b/windows/security/operating-system-security/device-management/windows-security-configuration-framework/security-compliance-toolkit-10.md index fa66e1ee5c..87e04bd53b 100644 --- a/windows/security/operating-system-security/device-management/windows-security-configuration-framework/security-compliance-toolkit-10.md +++ b/windows/security/operating-system-security/device-management/windows-security-configuration-framework/security-compliance-toolkit-10.md @@ -2,7 +2,7 @@ title: Microsoft Security Compliance Toolkit Guide description: This article describes how to use Security Compliance Toolkit in your organization. ms.topic: conceptual -ms.date: 10/31/2023 +ms.date: 07/10/2024 --- # Microsoft Security Compliance Toolkit - How to use diff --git a/windows/security/operating-system-security/device-management/windows-security-configuration-framework/windows-security-baselines.md b/windows/security/operating-system-security/device-management/windows-security-configuration-framework/windows-security-baselines.md index 851c7a72c1..436a88a7a3 100644 --- a/windows/security/operating-system-security/device-management/windows-security-configuration-framework/windows-security-baselines.md +++ b/windows/security/operating-system-security/device-management/windows-security-configuration-framework/windows-security-baselines.md @@ -2,7 +2,7 @@ title: Security baselines guide description: Learn how to use security baselines in your organization. ms.topic: conceptual -ms.date: 07/11/2023 +ms.date: 07/10/2024 --- # Security baselines @@ -19,7 +19,7 @@ For more information, see the following blog post: [Sticking with well-known and ## What are security baselines? -Every organization faces security threats. However, the types of security threats that are of most concern to one organization can be different from another organization. For example, an e-commerce company may focus on protecting its internet-facing web apps, while a hospital may focus on protecting confidential patient information. The one thing that all organizations have in common is a need to keep their apps and devices secure. These devices must be compliant with the security standards (or security baselines) defined by the organization. +Every organization faces security threats. However, the types of security threats that are of most concern to one organization can be different from another organization. For example, an e-commerce company might focus on protecting its internet-facing web apps, while a hospital might focus on protecting confidential patient information. The one thing that all organizations have in common is a need to keep their apps and devices secure. These devices must be compliant with the security standards (or security baselines) defined by the organization. A security baseline is a group of Microsoft-recommended configuration settings that explains their security implication. These settings are based on feedback from Microsoft security engineering teams, product groups, partners, and customers. diff --git a/windows/security/operating-system-security/index.md b/windows/security/operating-system-security/index.md index 4b093fe6f8..e8c0197c75 100644 --- a/windows/security/operating-system-security/index.md +++ b/windows/security/operating-system-security/index.md @@ -1,7 +1,7 @@ --- title: Windows operating system security description: Securing the operating system includes system security, encryption, network security, and threat protection. -ms.date: 08/02/2023 +ms.date: 07/10/2024 ms.topic: overview --- diff --git a/windows/security/operating-system-security/system-security/cryptography-certificate-mgmt.md b/windows/security/operating-system-security/system-security/cryptography-certificate-mgmt.md index 3dab6e2b51..5cff1aedaa 100644 --- a/windows/security/operating-system-security/system-security/cryptography-certificate-mgmt.md +++ b/windows/security/operating-system-security/system-security/cryptography-certificate-mgmt.md @@ -2,7 +2,7 @@ title: Cryptography and Certificate Management description: Get an overview of cryptography and certificate management in Windows ms.topic: conceptual -ms.date: 08/11/2023 +ms.date: 07/10/2024 ms.reviewer: skhadeer, raverma --- @@ -12,7 +12,7 @@ ms.reviewer: skhadeer, raverma Cryptography uses code to convert data so that only a specific recipient can read it by using a key. Cryptography enforces privacy to prevent anyone except the intended recipient from reading data, integrity to ensure data is free of tampering, and authentication that verifies identity to ensure that communication is secure. The cryptography stack in Windows extends from the chip to the cloud enabling Windows, applications, and services protect system and user secrets. -Cryptography in Windows is Federal Information Processing Standards (FIPS) 140 certified. FIPS 140 certification ensures that US government approved algorithms are being used (RSA for signing, ECDH with NIST curves for key agreement, AES for symmetric encryption, and SHA2 for hashing), tests module integrity to prove that no tampering has occurred and proves the randomness for entropy sources. +Cryptography in Windows is Federal Information Processing Standards (FIPS) 140 certified. FIPS 140 certification ensures that US government approved algorithms are being used (RSA for signing, ECDH with NIST curves for key agreement, AES for symmetric encryption, and SHA2 for hashing), tests module integrity to prove that no tampering occurred and proves the randomness for entropy sources. Windows cryptographic modules provide low-level primitives such as: diff --git a/windows/security/operating-system-security/system-security/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md b/windows/security/operating-system-security/system-security/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md index c30f214bdb..7cad827253 100644 --- a/windows/security/operating-system-security/system-security/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md +++ b/windows/security/operating-system-security/system-security/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md @@ -1,7 +1,7 @@ --- title: Control the health of Windows devices description: This article details an end-to-end solution that helps you protect high-value assets by enforcing, controlling, and reporting the health of Windows devices. -ms.date: 08/11/2023 +ms.date: 07/10/2024 ms.topic: conceptual --- @@ -11,7 +11,7 @@ This article details an end-to-end solution that helps you protect high-value as ## Introduction -For Bring Your Own Device (BYOD) scenarios, employees bring commercially available devices to access both work-related resources and their personal data. Users want to use the device of their choice to access the organization's applications, data, and resources not only from the internal network but also from anywhere. This phenomenon is also known as the consumerization of IT. +For Bring Your Own Device (BYOD) scenarios, users bring commercially available devices to access both work-related resources and their personal data. Users want to use the device of their choice to access the organization's applications, data, and resources not only from the internal network but also from anywhere. This phenomenon is also known as the consumerization of IT. Users want to have the best productivity experience when accessing corporate applications and working on organization data from their devices. That means they don't tolerate being prompted to enter their work credentials each time they access an application or a file server. From a security perspective, it also means that users manipulate corporate credentials and corporate data on unmanaged devices. @@ -27,7 +27,7 @@ Windows is an important component of an end-to-end security solution that focuse Today's computing threat landscape is increasing at a speed never encountered before. The sophistication of criminal attacks is growing, and there's no doubt that malware now targets both consumers and professionals in all industries. -During recent years, one particular category of threat has become prevalent: advanced persistent threats (APTs). The term APT is commonly used to describe any attack that seems to target individual organizations on an on-going basis. In fact, this type of attack typically involves determined adversaries who may use any methods or techniques necessary. +During recent years, one particular category of threat has become prevalent: advanced persistent threats (APTs). The term APT is commonly used to describe any attack that seems to target individual organizations on an ongoing basis. In fact, this type of attack typically involves determined adversaries who may use any methods or techniques necessary. With the BYOD phenomena, a poorly maintained device represents a target of choice. For an attacker, it's an easy way to breach the security network perimeter, gain access to, and then steal high-value assets. @@ -97,7 +97,7 @@ This section describes what Windows offers in terms of security defenses and wha ### Windows hardware-based security defenses -The most aggressive forms of malware try to insert themselves into the boot process as early as possible so that they can take control of the operating system early and prevent protection mechanisms and antimalware software from working. This type of malicious code is often called a rootkit or bootkit. The best way to avoid having to deal with low-level malware is to secure the boot process so that the device is protected from the very start. Windows supports multiple layers of boot protection. Some of these features are available only if specific types of hardware are installed. For more information, see the [Hardware requirements](#hardware-requirements) section. +The most aggressive forms of malware try to insert themselves into the boot process as early as possible so that they can take control of the operating system early and prevent protection mechanisms and anti-malware software from working. This type of malicious code is often called a rootkit or bootkit. The best way to avoid having to deal with low-level malware is to secure the boot process so that the device is protected from the very start. Windows supports multiple layers of boot protection. Some of these features are available only if specific types of hardware are installed. For more information, see the [Hardware requirements](#hardware-requirements) section. :::image type="content" alt-text="figure 4." source="images/hva-fig4-hardware.png"::: @@ -153,14 +153,14 @@ Windows supports features to help prevent sophisticated low-level malware like r - **Early Launch Antimalware (ELAM).** ELAM tests all drivers before they load and prevents unapproved drivers from loading. - Traditional antimalware apps don't start until after the boot drivers have been loaded, which gives a rootkit that is disguised as a driver the opportunity to work. ELAM is a Windows mechanism introduced in a previous version of Windows that allows antimalware software to run early in the boot sequence. Thus, the antimalware component is the first third-party component to run and control the initialization of other boot drivers until the Windows operating system is operational. When the system is started with a complete runtime environment (network access, storage, and so on), then a full-featured antimalware is loaded. + Traditional anti-malware apps don't start until after the boot drivers have been loaded, which gives a rootkit that is disguised as a driver the opportunity to work. ELAM is a Windows mechanism introduced in a previous version of Windows that allows anti-malware software to run early in the boot sequence. Thus, the anti-malware component is the first third-party component to run and control the initialization of other boot drivers until the Windows operating system is operational. When the system is started with a complete runtime environment (network access, storage, and so on), then a full-featured anti-malware is loaded. - ELAM can load a Microsoft or non-Microsoft antimalware driver before all non-Microsoft boot drivers and applications, thus continuing the chain of trust established by Secure Boot and Trusted Boot. Because the operating system hasn't started yet, and because Windows needs to boot as quickly as possible, ELAM has a simple task: Examine every boot driver and determine whether it is on the list of trusted drivers. If it's not trusted, Windows won't load it. + ELAM can load a Microsoft or non-Microsoft anti-malware driver before all non-Microsoft boot drivers and applications, thus continuing the chain of trust established by Secure Boot and Trusted Boot. Because the operating system hasn't started yet, and because Windows needs to boot as quickly as possible, ELAM has a simple task: Examine every boot driver and determine whether it is on the list of trusted drivers. If it's not trusted, Windows won't load it. > [!NOTE] > Windows Defender, Microsoft's antimalware included by default in Windows, supports ELAM; it can be replaced with a third-party antimalware compatible solution. The name of the Windows Defender ELAM driver is WdBoot.sys. Windows Defender uses its ELAM driver to roll back any malicious changes made to the Windows Defender driver at the next reboot. This prevents kernel mode malware making lasting changes to Windows Defender's mini-filter driver before shutdown or reboot. - The ELAM signed driver is loaded before any other third-party drivers or applications, which allows the antimalware software to detect and block any attempts to tamper with the boot process by trying to load unsigned or untrusted code. + The ELAM signed driver is loaded before any other third-party drivers or applications, which allows the anti-malware software to detect and block any attempts to tamper with the boot process by trying to load unsigned or untrusted code. The ELAM driver is a small driver with a small policy database that has a narrow scope, focused on drivers that are loaded early at system launch. The policy database is stored in a registry hive that is also measured to the TPM, to record the operational parameters of the ELAM driver. An ELAM driver must be signed by Microsoft and the associated certificate must contain the complementary EKU (1.3.6.1.4.1.311.61.4.1). @@ -170,9 +170,9 @@ Windows supports features to help prevent sophisticated low-level malware like r - **Hypervisor-protected Code Integrity (HVCI).** Hypervisor-protected Code Integrity is a feature of Device Guard that ensures only drivers, executables, and DLLs that comply with the Device Guard Code Integrity policy are allowed to run. - When enabled and configured, Windows can start the Hyper-V virtualization-based security services. HVCI helps protect the system core (kernel), privileged drivers, and system defenses, like antimalware solutions, by preventing malware from running early in the boot process, or after startup. + When enabled and configured, Windows can start the Hyper-V Virtualization-based security services. HVCI helps protect the system core (kernel), privileged drivers, and system defenses, like anti-malware solutions, by preventing malware from running early in the boot process, or after startup. - HVCI uses virtualization-based security to isolate Code Integrity, the only way kernel memory can become executable is through a Code Integrity verification. This dependency on verification means that kernel memory pages can never be Writable and Executable (W+X) and executable code can't be directly modified. + HVCI uses Virtualization-based security to isolate Code Integrity, the only way kernel memory can become executable is through a Code Integrity verification. This dependency on verification means that kernel memory pages can never be Writable and Executable (W+X) and executable code can't be directly modified. > [!NOTE] > Device Guard devices that run Kernel Mode Code Integrity with virtualization-based security must have compatible drivers. For additional information, please read the [Driver compatibility with Device Guard in Windows](https://techcommunity.microsoft.com/t5/windows-hardware-certification/driver-compatibility-with-device-guard-in-windows-10/ba-p/364865) blog post. @@ -184,17 +184,17 @@ Windows supports features to help prevent sophisticated low-level malware like r In Windows, Credential Guard aims to protect domain corporate credentials from theft and reuse by malware. With Credential Guard, Windows implemented an architectural change that fundamentally prevents the current forms of the pass-the-hash (PtH) attack. - This attack-free state is accomplished by using Hyper-V and the new virtualization-based security feature to create a protected container where trusted code and secrets are isolated from the Windows kernel. This accomplishment means that even if the Windows kernel is compromised, an attacker has no way to read and extract the data required to initiate a PtH attack. Credential Guard prevents this unauthorized access because the memory where secrets are stored is no longer accessible from the regular OS, even in kernel mode - the hypervisor controls who can access the memory. + This attack-free state is accomplished by using Hyper-V and the new Virtualization-based security feature to create a protected container where trusted code and secrets are isolated from the Windows kernel. This accomplishment means that even if the Windows kernel is compromised, an attacker has no way to read and extract the data required to initiate a PtH attack. Credential Guard prevents this unauthorized access because the memory where secrets are stored is no longer accessible from the regular OS, even in kernel mode - the hypervisor controls who can access the memory. - **Health attestation.** The device's firmware logs the boot process, and Windows can send it to a trusted server that can check and assess the device's health. - Windows takes measurements of the UEFI firmware and each of the Windows and antimalware components are made as they load during the boot process. Additionally, they're taken and measured sequentially, not all at once. When these measurements are complete, their values are digitally signed and stored securely in the TPM and can't be changed unless the system is reset. + Windows takes measurements of the UEFI firmware and each of the Windows and anti-malware components are made as they load during the boot process. Additionally, they're taken and measured sequentially, not all at once. When these measurements are complete, their values are digitally signed and stored securely in the TPM and can't be changed unless the system is reset. For more information, see [Secured Boot and Measured Boot: Hardening Early Boot Components Against Malware](/previous-versions/windows/hardware/design/dn653311(v=vs.85)). During each subsequent boot, the same components are measured, which allows comparison of the measurements against an expected baseline. For more security, the values measured by the TPM can be signed and transmitted to a remote server, which can then perform the comparison. This process, called *remote device health attestation*, allows the server to verify health status of the Windows device. - Although Secure Boot is a proactive form of protection, health attestation is a reactive form of boot protection. Health attestation ships disabled in Windows and is enabled by an antimalware or an MDM vendor. Unlike Secure Boot, health attestation won't stop the boot process and enter remediation when a measurement doesn't work. But with conditional access control, health attestation will help to prevent access to high-value assets. + Although Secure Boot is a proactive form of protection, health attestation is a reactive form of boot protection. Health attestation ships disabled in Windows and is enabled by an anti-malware or an MDM vendor. Unlike Secure Boot, health attestation won't stop the boot process and enter remediation when a measurement doesn't work. But with conditional access control, health attestation helps to prevent access to high-value assets. ### Virtualization-based security @@ -202,16 +202,16 @@ Virtualization-based security provides a new trust boundary for Windows and uses Virtualization-based security helps to protect against a compromised kernel or a malicious user with Administrator privileges. Virtualization-based security isn't trying to protect against a physical attacker. -The following Windows services are protected with virtualization-based security: +The following Windows services are protected with Virtualization-based security: - **Credential Guard** (LSA Credential Isolation): prevents pass-the-hash attacks and enterprise credential theft that happens by reading and dumping the content of lsass memory -- **Device Guard** (Hyper-V Code Integrity): Device Guard uses the new virtualization-based security in Windows to isolate the Code Integrity service from the Windows kernel itself, which lets the service use signatures defined by your enterprise-controlled policy to help determine what is trustworthy. In effect, the Code Integrity service runs alongside the kernel in a Windows hypervisor-protected container. +- **Device Guard** (Hyper-V Code Integrity): Device Guard uses the new Virtualization-based security in Windows to isolate the Code Integrity service from the Windows kernel itself, which lets the service use signatures defined by your enterprise-controlled policy to help determine what is trustworthy. In effect, the Code Integrity service runs alongside the kernel in a Windows hypervisor-protected container. - **Other isolated services**: for example, on Windows Server 2016, there's the vTPM feature that allows you to have encrypted virtual machines (VMs) on servers. > [!NOTE] > Virtualization-based security is only available with Enterprise edition. Virtualization-based security requires devices with UEFI (2.3.1 or higher) with Secure Boot enabled, x64 processor with Virtualization Extensions and SLAT enabled. IOMMU, TPM 2.0. and support for Secure Memory overwritten are optional, but recommended. -The schema below is a high-level view of Windows with virtualization-based security. +The schema below is a high-level view of Windows with Virtualization-based security. :::image type="content" alt-text="figure 5." source="images/hva-fig5-virtualbasedsecurity.png"::: @@ -231,7 +231,7 @@ credential isolation is enabled, it then spawns LsaIso.exe as an isolated proces Device Guard is a feature of Windows Enterprise that allows organizations to lock down a device to help protect it from running untrusted software. In this configuration, the only applications allowed to run are those applications that are trusted by the organization. -The trust decision to execute code is performed by using Hyper-V Code Integrity, which runs in virtualization-based security, a Hyper-V protected container that runs alongside regular Windows. +The trust decision to execute code is performed by using Hyper-V Code Integrity, which runs in Virtualization-based security, a Hyper-V protected container that runs alongside regular Windows. Hyper-V Code Integrity is a feature that validates the integrity of a driver or system file each time it's loaded into memory. Code integrity detects whether an unsigned driver or system file is being loaded into the kernel, or whether a system file has been modified by malicious software that is being run by a user account with Administrator privileges. On x64-based versions of Windows, kernel-mode drivers must be digitally signed. @@ -252,7 +252,7 @@ Device Guard needs to be planned and configured to be truly effective. It isn't There are three different parts that make up the Device Guard solution in Windows: - The first part is a base **set of hardware security features** introduced with the previous version of Windows. TPM for hardware cryptographic operations and UEFI with modern firmware, along with Secure Boot, allows you to control what the device is running when the systems start. -- After the hardware security feature, there's the code integrity engine. In Windows, **Code Integrity is now fully configurable** and now resides in Isolated user mode, a part of the memory that is protected by virtualization-based security. +- After the hardware security feature, there's the code integrity engine. In Windows, **Code Integrity is now fully configurable** and now resides in Isolated user mode, a part of the memory that is protected by Virtualization-based security. - The last part of Device Guard is **manageability**. Code Integrity configuration is exposed through specific Group Policy Objects, PowerShell cmdlets, and MDM configuration service providers (CSPs). For more information on how to deploy Device Guard in an enterprise, see the [Device Guard deployment guide](/windows/device-security/device-guard/device-guard-deployment-guide). @@ -270,7 +270,7 @@ To protect high-value assets, SAWs are used to make secure connections to those Similarly, on corporate fully managed workstations, where applications are installed by using a distribution tool like Microsoft Configuration Manager, Intune, or any third-party device management, then Device Guard is applicable. In that type of scenario, the organization has a good idea of the software that an average user is running. -It could be challenging to use Device Guard on corporate, lightly managed workstations where the user is typically allowed to install software on their own. When an organization offers great flexibility, it's difficult to run Device Guard in enforcement mode. Nevertheless, Device Guard can be run in Audit mode, and in that case, the event log will contain a record of any binaries that violated the Device Guard policy. When Device Guard is used in Audit mode, organizations can get rich data about drivers and applications that users install and run. +It could be challenging to use Device Guard on corporate, lightly managed workstations where the user is typically allowed to install software on their own. When an organization offers great flexibility, it's difficult to run Device Guard in enforcement mode. Nevertheless, Device Guard can be run in Audit mode, and in that case, the event log contains a record of any binaries that violated the Device Guard policy. When Device Guard is used in Audit mode, organizations can get rich data about drivers and applications that users install and run. Before you can benefit from the protection included in Device Guard, Code Integrity policy must be created by using tools provided by Microsoft, but the policy can be deployed with common management tools, like Group Policy. The Code Integrity policy is a binary-encoded XML document that includes configuration settings for both the User and Kernel-modes of Windows, along with restrictions on Windows script hosts. Device Guard Code Integrity policy restricts what code can run on a device. @@ -286,14 +286,14 @@ Device Guard policy into the UpdateSigner section. On computers with Device Guard, Microsoft proposes to move from a world where unsigned apps can be run without restriction to a world where only signed and trusted code is allowed to run on Windows. -With Windows, organizations will make line-of-business (LOB) apps available to members of the organization through the Microsoft Store infrastructure. More specifically, LOB apps will be available in a private store within the public Microsoft Store. Microsoft Store signs and distributes Universal +With Windows, organizations make line-of-business (LOB) apps available to members of the organization through the Microsoft Store infrastructure. More specifically, LOB apps are available in a private store within the public Microsoft Store. Microsoft Store signs and distributes Universal Windows apps and Classic Windows apps. All apps downloaded from the Microsoft Store are signed. In organizations today, many LOB applications are unsigned. Code signing is frequently viewed as a tough problem to solve for various reasons, like the lack of code signing expertise. Even if code signing is a best practice, many internal applications aren't signed. Windows includes tools that allow IT pros to take applications that have been already packaged and run them through a process to create more signatures that can be distributed along with existing applications. -### Why are antimalware and device management solutions still necessary? +### Why are anti-malware and device management solutions still necessary? Although allowlist mechanisms are efficient at ensuring that only trusted applications can be run, they can't prevent the compromise of a trusted (but vulnerable) application by malicious content designed to exploit a known vulnerability. Device Guard doesn't protect against user mode malicious code run by exploiting vulnerabilities. @@ -301,7 +301,7 @@ Vulnerabilities are weaknesses in software that could allow an attacker to compr It's common to see attackers distributing specially crafted content in an attempt to exploit known vulnerabilities in user mode software like web browsers (and their plug-ins), Java virtual machines, PDF readers, or document editors. As of today, 90 percent of discovered vulnerabilities affect user mode applications compared to the operating system and kernel mode drivers that host them. -To combat these threats, patching is the single most effective control, with antimalware software forming complementary layers of defense. +To combat these threats, patching is the single most effective control, with anti-malware software forming complementary layers of defense. Most application software has no facility for updating itself, so even if the software vendor publishes an update that fixes the vulnerability, the user may not know that the update is available or how to obtain it, and therefore remains vulnerable to attack. Organizations still need to manage devices and to patch vulnerabilities. @@ -319,15 +319,15 @@ For more information on device health attestation, see the [Detect an unhealthy ### Hardware requirements -The following table details the hardware requirements for both virtualization-based security services and the health attestation feature. For more information, see [Minimum hardware requirements](/windows-hardware/design/minimum/minimum-hardware-requirements-overview). +The following table details the hardware requirements for both Virtualization-based security services and the health attestation feature. For more information, see [Minimum hardware requirements](/windows-hardware/design/minimum/minimum-hardware-requirements-overview). |Hardware|Motivation| |--- |--- | |UEFI 2.3.1 or later firmware with Secure Boot enabled|Required to support UEFI Secure Boot. UEFI Secure Boot ensures that the device boots only authorized code. Additionally, Boot Integrity (Platform Secure Boot) must be supported following the requirements in Hardware Compatibility Specification for Systems for Windows under the subsection: "System.Fundamentals.Firmware.CS.UEFISecureBoot.ConnectedStandby"| -|Virtualization extensions, such as Intel VT-x, AMD-V, and SLAT must be enabled|Required to support virtualization-based security. **Note:** Device Guard can be enabled without using virtualization-based security.| -|X64 processor|Required to support virtualization-based security that uses Windows Hypervisor. Hyper-V is supported only on x64 processor (and not on x86). Direct Memory Access (DMA) protection can be enabled to provide extra memory protection but requires processors to include DMA protection technologies.| +|Virtualization extensions, such as Intel VT-x, AMD-V, and SLAT must be enabled|Required to support Virtualization-based security. **Note:** Device Guard can be enabled without using Virtualization-based security.| +|X64 processor|Required to support Virtualization-based security that uses Windows Hypervisor. Hyper-V is supported only on x64 processor (and not on x86). Direct Memory Access (DMA) protection can be enabled to provide extra memory protection but requires processors to include DMA protection technologies.| |IOMMU, such as Intel VT-d, AMD-Vi|Support for the IOMMU in Windows enhances system resiliency against DMA attacks.| -|Trusted Platform Module (TPM)|Required to support health attestation and necessary for other key protections for virtualization-based security. TPM 2.0 is supported. Support for TPM 1.2 was added beginning in Windows 10, version 1607 (RS1)| +|Trusted Platform Module (TPM)|Required to support health attestation and necessary for other key protections for Virtualization-based security. TPM 2.0 is supported. Support for TPM 1.2 was added beginning in Windows 10, version 1607 (RS1)| This section presented information about several closely related controls in Windows . The multi-layer defenses and in-depth approach help to eradicate low-level malware during boot sequence. Virtualization-based security is a fundamental operating system architecture change that adds a new security boundary. Device Guard and Credential Guard respectively help to block untrusted code and protect corporate domain credentials from theft and reuse. This section also briefly discussed the importance of managing devices and patching vulnerabilities. All these technologies can be used to harden and lock down devices while limiting the risk of attackers compromising them. @@ -335,7 +335,7 @@ This section presented information about several closely related controls in Win As of today, many organizations only consider devices to be compliant with company policy after they've passed various checks that show, for example, that the operating system is in the correct state, properly configured, and has security protection enabled. Unfortunately, with today's systems, this form of reporting isn't entirely reliable because malware can spoof a software statement about system health. A rootkit, or a similar low-level exploit, can report a false healthy state to traditional compliance tools. -The biggest challenge with rootkits is that they can be undetectable to the client. Because they start before antimalware, and they have system-level privileges, they can completely disguise themselves while continuing to access system resources. As a result, traditional computers infected with rootkits appear to be healthy, even with antimalware running. +The biggest challenge with rootkits is that they can be undetectable to the client. Because they start before anti-malware, and they have system-level privileges, they can completely disguise themselves while continuing to access system resources. As a result, traditional computers infected with rootkits appear to be healthy, even with anti-malware running. As previously discussed, the health attestation feature of Windows uses the TPM hardware component to securely record a measurement of every boot-related component, including firmware, Windows kernel, and even early boot drivers. Because health attestation uses the hardware-based security capabilities of TPM, the log of all boot measured components remains out of the reach of any malware. @@ -345,9 +345,9 @@ After the devices attest a trusted boot state, they can prove that they aren't r To understand the concept of device health, it's important to know traditional measures that IT pros have taken to prevent the breach of malware. Malware control technologies are highly focused on the prevention of installation and distribution. -However, the use of traditional malware prevention technologies like antimalware or patching solutions brings a new set of issues for IT pros: the ability to monitor and control the compliance of devices accessing organization's resources. +However, the use of traditional malware prevention technologies like anti-malware or patching solutions brings a new set of issues for IT pros: the ability to monitor and control the compliance of devices accessing organization's resources. -The definition of device compliance will vary based on an organization's installed antimalware, device configuration settings, patch management baseline, and other security requirements. But health of the device is part of the overall device compliance policy. +The definition of device compliance will vary based on an organization's installed anti-malware, device configuration settings, patch management baseline, and other security requirements. But health of the device is part of the overall device compliance policy. The health of the device isn't binary and depends on the organization's security implementation. The Health Attestation Service provides information back to the MDM on which security features are enabled during the boot of the device by using trustworthy hardware TPM. @@ -364,13 +364,13 @@ A relying party like an MDM can inspect the report generated by the remote healt > [!NOTE] > To use the health attestation feature of Windows, the device must be equipped with a discrete or firmware TPM. There is no restriction on any particular edition of Windows. -Windows supports health attestation scenarios by allowing applications access to the underlying health attestation configuration service provider (CSP) so that applications can request a health attestation token. The measurement of the boot sequence can be checked at any time locally by an antimalware or an MDM agent. +Windows supports health attestation scenarios by allowing applications access to the underlying health attestation configuration service provider (CSP) so that applications can request a health attestation token. The measurement of the boot sequence can be checked at any time locally by an anti-malware or an MDM agent. Remote device health attestation combined with an MDM provides a hardware-rooted method for reporting the current security status and detecting any changes, without having to trust the software running on the system. -In the case where malicious code is running on the device, the use of a remote server is required. If a rootkit is present on the device, the antimalware is no longer reliable, and its behavior can be hijacked by a malicious code running early in the startup sequence. This reason is what makes it important to use Secure Boot and Device Guard, to control which code is loaded during the boot sequence. +In the case where malicious code is running on the device, the use of a remote server is required. If a rootkit is present on the device, the anti-malware is no longer reliable, and its behavior can be hijacked by a malicious code running early in the startup sequence. This reason is what makes it important to use Secure Boot and Device Guard, to control which code is loaded during the boot sequence. -The antimalware software can search to determine whether the boot sequence contains any signs of malware, such as a rootkit. It can also send the TCG log and the PCRs to a remote health attestation server to provide a separation between the measurement component and the verification component. +The anti-malware software can search to determine whether the boot sequence contains any signs of malware, such as a rootkit. It can also send the TCG log and the PCRs to a remote health attestation server to provide a separation between the measurement component and the verification component. Health attestation logs the measurements in various TPM Platform Configuration Registers (PCRs) and TCG logs during the boot process. @@ -602,7 +602,7 @@ The figure below shows how the Health Attestation Service is expected to work wi :::image type="content" alt-text="figure 10." source="images/hva-fig9-intune.png"::: -An MDM solution can then use health state statements and take them to the next level by coupling with client policies that will enable conditional access to be granted based on the device's ability to prove that it's malware free, its antimalware system is functional and up to date, the +An MDM solution can then use health state statements and take them to the next level by coupling with client policies that will enable conditional access to be granted based on the device's ability to prove that it's malware free, its anti-malware system is functional and up to date, the firewall is running, and the devices patch state is compliant. Finally, resources can be protected by denying access to endpoints that are unable to prove they're healthy. This feature is much needed for BYOD devices that need to access organizational resources. @@ -736,7 +736,7 @@ The following list contains high-level key takeaways to improve the security pos - **Use virtualization-based security** - When you have Kernel Mode Code Integrity protected by virtualization-based security, the code integrity rules are still enforced even if a vulnerability allows unauthorized kernel mode memory access. Keep in mind that Device Guard devices that run Kernel Code Integrity with virtualization-based security must have compatible drivers. + When you have Kernel Mode Code Integrity protected by Virtualization-based security, the code integrity rules are still enforced even if a vulnerability allows unauthorized kernel mode memory access. Keep in mind that Device Guard devices that run Kernel Code Integrity with Virtualization-based security must have compatible drivers. - **Start to deploy Device Guard with Audit mode** @@ -756,7 +756,7 @@ The following list contains high-level key takeaways to improve the security pos Health attestation is a key feature of Windows that includes client and cloud components to control access to high-value assets based on a user and their device's identity and compliance with corporate governance policy. Organizations can choose to detect and report unhealthy devices, or to configure health enforcement rules based on their needs. Health attestation provides an end-to-end security model and integration points, which vendors and software developers can use to build and integrate a customized solution. -## Related topics +## Related articles - [Protect derived domain credentials with Credential Guard](/windows/access-protection/credential-guard/credential-guard) - [Device Guard deployment guide](/windows/device-security/device-guard/device-guard-deployment-guide) diff --git a/windows/security/operating-system-security/system-security/secure-the-windows-10-boot-process.md b/windows/security/operating-system-security/system-security/secure-the-windows-10-boot-process.md index 3daa0cbf86..c931ca2dcb 100644 --- a/windows/security/operating-system-security/system-security/secure-the-windows-10-boot-process.md +++ b/windows/security/operating-system-security/system-security/secure-the-windows-10-boot-process.md @@ -2,7 +2,7 @@ title: Secure the Windows boot process description: This article describes how Windows security features help protect your PC from malware, including rootkits and other applications. ms.topic: conceptual -ms.date: 08/11/2023 +ms.date: 07/10/2024 ms.collection: - tier1 --- @@ -73,7 +73,7 @@ These requirements help protect you from rootkits while allowing you to run any To prevent malware from abusing these options, the user must manually configure the UEFI firmware to trust a non-certified bootloader or to turn off Secure Boot. Software can't change the Secure Boot settings. -The default state of Secure Boot has a wide circle of trust, which can result in customers trusting boot components they may not need. Since the Microsoft 3rd Party UEFI CA certificate signs the bootloaders for all Linux distributions, trusting the Microsoft 3rd Party UEFI CA signature in the UEFI database increase s the attack surface of systems. A customer who intended to only trust and boot a single Linux distribution will trust all distributions - much more than their desired configuration. A vulnerability in any of the bootloaders exposes the system and places the customer at risk of exploit for a bootloader they never intended to use, as seen in recent vulnerabilities, for example [with the GRUB bootloader](https://msrc.microsoft.com/security-guidance/advisory/ADV200011) or [firmware-level rootkit]( https://www.darkreading.com/threat-intelligence/researchers-uncover-dangerous-new-firmware-level-rootkit) affecting boot components. [Secured-core PCs](/windows-hardware/design/device-experiences/OEM-highly-secure-11) require Secure Boot to be enabled and configured to distrust the Microsoft 3rd Party UEFI CA signature, by default, to provide customers with the most secure configuration of their PCs possible. +The default state of Secure Boot has a wide circle of trust, which can result in customers trusting boot components they may not need. Since the Microsoft 3rd Party UEFI CA certificate signs the bootloaders for all Linux distributions, trusting the Microsoft 3rd Party UEFI CA signature in the UEFI database increase s the attack surface of systems. A customer who intended to only trust and boot a single Linux distribution will trust all distributions - more than their desired configuration. A vulnerability in any of the bootloaders exposes the system and places the customer at risk of exploit for a bootloader they never intended to use, as seen in recent vulnerabilities, for example [with the GRUB bootloader](https://msrc.microsoft.com/security-guidance/advisory/ADV200011) or [firmware-level rootkit]( https://www.darkreading.com/threat-intelligence/researchers-uncover-dangerous-new-firmware-level-rootkit) affecting boot components. [Secured-core PCs](/windows-hardware/design/device-experiences/OEM-highly-secure-11) require Secure Boot to be enabled and configured to distrust the Microsoft 3rd Party UEFI CA signature, by default, to provide customers with the most secure configuration of their PCs possible. To trust and boot operating systems, like Linux, and components signed by the UEFI signature, Secured-core PCs can be configured in the BIOS menu to add the signature in the UEFI database by following these steps: @@ -91,11 +91,11 @@ Like most mobile devices, Arm-based devices, such as the Microsoft Surface RT de Trusted Boot takes over where Secure Boot ends. The bootloader verifies the digital signature of the Windows kernel before loading it. The Windows kernel, in turn, verifies every other component of the Windows startup process, including the boot drivers, startup files, and ELAM. If a file has been modified, the bootloader detects the problem and refuses to load the corrupted component. Often, Windows can automatically repair the corrupted component, restoring the integrity of Windows and allowing the PC to start normally. -## Early Launch Anti-Malware +## Early Launch anti-malware Because Secure Boot has protected the bootloader and Trusted Boot has protected the Windows kernel, the next opportunity for malware to start is by infecting a non-Microsoft boot driver. Traditional anti-malware apps don't start until after the boot drivers have been loaded, giving a rootkit disguised as a driver the opportunity to work. -Early Launch Anti-Malware (ELAM) can load a Microsoft or non-Microsoft anti-malware driver before all non-Microsoft boot drivers and applications, thus continuing the chain of trust established by Secure Boot and Trusted Boot. Because the OS hasn't started yet, and because Windows needs to boot as quickly as possible, ELAM has a simple task: examine every boot driver and determine whether it is on the list of trusted drivers. If it's not trusted, Windows doesn't load it. +Early Launch anti-malware (ELAM) can load a Microsoft or non-Microsoft anti-malware driver before all non-Microsoft boot drivers and applications, thus continuing the chain of trust established by Secure Boot and Trusted Boot. Because the OS hasn't started yet, and because Windows needs to boot as quickly as possible, ELAM has a simple task: examine every boot driver and determine whether it is on the list of trusted drivers. If it's not trusted, Windows doesn't load it. An ELAM driver isn't a full-featured anti-malware solution; that loads later in the boot process. Windows Defender (included with Windows) supports ELAM, as does several non-Microsoft anti-malware apps. diff --git a/windows/security/operating-system-security/system-security/trusted-boot.md b/windows/security/operating-system-security/system-security/trusted-boot.md index 431c65c17d..4da0621dc6 100644 --- a/windows/security/operating-system-security/system-security/trusted-boot.md +++ b/windows/security/operating-system-security/system-security/trusted-boot.md @@ -2,7 +2,7 @@ title: Secure Boot and Trusted Boot description: Trusted Boot prevents corrupted components from loading during the boot-up process in Windows 11 ms.topic: conceptual -ms.date: 10/30/2023 +ms.date: 07/10/2024 ms.reviewer: jsuther appliesto: - "βœ… Windows 11" @@ -10,15 +10,15 @@ appliesto: # Secure Boot and Trusted Boot -*This article describes Secure Boot and Trusted Boot, security measures built into Windows 11.* +This article describes Secure Boot and Trusted Boot, security measures built into Windows 11. Secure Boot and Trusted Boot help prevent malware and corrupted components from loading when a Windows 11 device is starting. Secure Boot starts with initial boot-up protection, and then Trusted Boot picks up the process. Together, Secure Boot and Trusted Boot help to ensure your Windows 11 system boots up safely and securely. ## Secure Boot -The first step in protecting the operating system is to ensure that it boots securely after the initial hardware and firmware boot sequences have safely finished their early boot sequences. Secure Boot makes a safe and trusted path from the Unified Extensible Firmware Interface (UEFI) through the Windows kernel's Trusted Boot sequence. Malware attacks on the Windows boot sequence are blocked by the signature-enforcement handshakes throughout the boot sequence between the UEFI, bootloader, kernel, and application environments. +The first step in protecting the operating system is to ensure that it boots securely after the initial hardware and firmware boot sequences safely finish their early boot sequences. Secure Boot makes a safe and trusted path from the Unified Extensible Firmware Interface (UEFI) through the Windows kernel's Trusted Boot sequence. Malware attacks on the Windows boot sequence are blocked by the signature-enforcement handshakes throughout the boot sequence between the UEFI, bootloader, kernel, and application environments. -As the PC begins the boot process, it first verifies that the firmware is digitally signed, reducing the risk of firmware rootkits. Secure Boot then checks all code that runs before the operating system and checks the OS bootloader's digital signature to ensure that it's trusted by the Secure Boot policy and hasn't been tampered with. +As the PC begins the boot process, it first verifies that the firmware is digitally signed, reducing the risk of firmware rootkits. Secure Boot then checks all code that runs before the operating system, and checks the OS bootloader's digital signature to ensure that it's trusted by the Secure Boot policy and hasn't been tampered with. ## Trusted Boot diff --git a/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/available-settings.md b/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/available-settings.md index 5968d29a6c..a416410eb0 100644 --- a/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/available-settings.md +++ b/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/available-settings.md @@ -1,65 +1,59 @@ --- -title: Available Microsoft Defender SmartScreen Group Policy and mobile device management (MDM) settings +title: Available Microsoft Defender SmartScreen settings description: A list of all available settings for Microsoft Defender SmartScreen using Group Policy and mobile device management (MDM) settings. -ms.date: 08/11/2023 +ms.date: 07/10/2024 ms.topic: reference --- # Available Microsoft Defender SmartScreen Group Policy and mobile device management (MDM) settings -Microsoft Defender SmartScreen works with Intune, Group Policy, and mobile device management (MDM) settings to help you manage your organization's computer settings. Based on how you set up Microsoft Defender SmartScreen, you can show employees a warning page and let them continue to the site, or you can block the site entirely. +Microsoft Defender SmartScreen works with Intune, Group Policy, and mobile device management (MDM) settings to help you manage your organization's computer settings. Based on how you set up Microsoft Defender SmartScreen, you can show users a warning page and let them continue to the site, or you can block the site entirely. -See [Windows 10 and Windows 11 settings to protect devices using Intune](/intune/endpoint-protection-windows-10#windows-defender-smartscreen-settings) for the controls you can use in Intune. +See [Windows settings to protect devices using Intune](/intune/endpoint-protection-windows-10#windows-defender-smartscreen-settings) for the controls you can use in Intune. + +> [!NOTE] +> For a list of settings available for Enhanced phishing protection, see [Enhanced phishing protection](enhanced-phishing-protection.md#configure-enhanced-phishing-protection-for-your-organization). ## Group Policy settings SmartScreen uses registry-based Administrative Template policy settings. -Setting|Supported on|Description| -|--- |--- |--- | -|**Windows 10, version 2004:** Administrative Templates\Windows Components\Windows Defender SmartScreen\Explorer\Configure Windows Defender SmartScreen|**Windows 10, version 1703:** Administrative Templates\Windows Components\Windows Defender SmartScreen\Explorer\Configure Windows Defender SmartScreen

**Windows 10, Version 1607 and earlier:** Administrative Templates\Windows Components\File Explorer\Configure Windows SmartScreen

**At least Windows Server 2012, Windows 8 or Windows RT**|This policy setting turns on Microsoft Defender SmartScreen.

If you enable this setting, it turns on Microsoft Defender SmartScreen and your employees are unable to turn it off. Additionally, when enabling this feature, you must also pick whether Microsoft Defender SmartScreen should Warn your employees or Warn and prevent bypassing the message (effectively blocking the employee from the site).

If you disable this setting, it turns off Microsoft Defender SmartScreen and your employees are unable to turn it on.

If you don't configure this setting, your employees can decide whether to use Microsoft Defender SmartScreen.| -|**Windows 10, version 2004:** Administrative Templates\Windows Components\Windows Defender SmartScreen\Explorer\Configure App Install Control|**Windows 10, version 1703:** Administrative Templates\Windows Components\Windows Defender SmartScreen\Explorer\Configure App Install Control|This policy setting is intended to prevent malicious content from affecting your user's devices when downloading executable content from the internet.

This setting doesn't protect against malicious content from USB devices, network shares, or other non-internet sources.

**Important:** Using a trustworthy browser helps ensure that these protections work as expected.| -|**Windows 10, version 2004:** Administrative Templates\Windows Components\Windows Defender SmartScreen\Microsoft Edge\Configure Windows Defender SmartScreen (Microsoft Edge version 45 and earlier)

Administrative Templates\Microsoft Edge\SmartScreen settings\Configure Microsoft Defender SmartScreen (Microsoft Edge version 77 or later)

**Windows 10, version 1703:** Administrative Templates\Windows Components\Windows Defender SmartScreen\Microsoft Edge\Configure Windows Defender SmartScreen (Microsoft Edge version 45 and earlier)

Administrative Templates\Microsoft Edge\SmartScreen settings\Configure Microsoft Defender SmartScreen (Microsoft Edge version 77 or later)

**Windows 10, Version 1607 and earlier:** Administrative Templates\Windows Components\Microsoft Edge\Configure Windows SmartScreen|Microsoft Edge on Windows 10 or Windows 11|This policy setting turns on Microsoft Defender SmartScreen.

If you enable this setting, it turns on Microsoft Defender SmartScreen and your employees are unable to turn it off.

If you disable this setting, it turns off Microsoft Defender SmartScreen and your employees are unable to turn it on.

If you don't configure this setting, your employees can decide whether to use Microsoft Defender SmartScreen.| -|**Windows 10, version 2004:** Administrative Templates\Windows Components\Windows Defender SmartScreen\Microsoft Edge\Prevent bypassing Windows Defender SmartScreen prompts for files (Microsoft Edge version 45 and earlier)

Administrative Templates\Microsoft Edge\SmartScreen settings\Prevent bypassing of Microsoft Defender SmartScreen warnings about downloads (Microsoft Edge version 77 or later)

**Windows 10, version 1703:** Administrative Templates\Windows Components\Windows Defender SmartScreen\Microsoft Edge\Prevent bypassing Windows Defender SmartScreen prompts for files (Microsoft Edge version 45 and earlier)

Administrative Templates\Microsoft Edge\SmartScreen settings\Prevent bypassing of Microsoft Defender SmartScreen warnings about downloads (Microsoft Edge version 77 or later)

**Windows 10, Version 1511 and 1607:** Administrative Templates\Windows Components\Microsoft Edge\Prevent bypassing Windows SmartScreen prompts for files|Microsoft Edge on Windows 10, version 1511 or later|This policy setting stops employees from bypassing the Microsoft Defender SmartScreen warnings about potentially malicious files.

If you enable this setting, it stops employees from bypassing the warning, stopping the file download.

If you disable or don't configure this setting, your employees can bypass the warnings and continue to download potentially malicious files.| -|**Windows 10, version 2004:** Administrative Templates\Windows Components\Windows Defender SmartScreen\Microsoft Edge\Prevent bypassing Windows Defender SmartScreen prompts for sites (Microsoft Edge version 45 and earlier)

Administrative Templates\Microsoft Edge\SmartScreen settings\Prevent bypassing Microsoft Defender SmartScreen prompts for sites (Microsoft Edge version 77 or later)

**Windows 10, version 1703:** Administrative Templates\Windows Components\Windows Defender SmartScreen\Microsoft Edge\Prevent bypassing Windows Defender SmartScreen prompts for sites (Microsoft Edge version 45 and earlier)

Administrative Templates\Microsoft Edge\SmartScreen settings\Prevent bypassing Microsoft Defender SmartScreen prompts for sites (Microsoft Edge version 77 or later)

**Windows 10, Version 1511 and 1607:** Administrative Templates\Windows Components\Microsoft Edge\Prevent bypassing Windows SmartScreen prompts for sites|Microsoft Edge on Windows 10, version 1511 or later|This policy setting stops employees from bypassing the Microsoft Defender SmartScreen warnings about potentially malicious sites.

If you enable this setting, it stops employees from bypassing the warning, stopping them from going to the site.

If you disable or don't configure this setting, your employees can bypass the warnings and continue to visit a potentially malicious site.| -|Administrative Templates\Windows Components\Internet Explorer\Prevent managing SmartScreen Filter|Internet Explorer 9 or later|This policy setting prevents the employee from managing Microsoft Defender SmartScreen.

If you enable this policy setting, the employee isn't prompted to turn on Microsoft Defender SmartScreen. All website addresses that aren't on the filter's allowlist are sent automatically to Microsoft without prompting the employee.

If you disable or don't configure this policy setting, the employee is prompted to decide whether to turn on Microsoft Defender SmartScreen during the first-run experience.| -|Administrative Templates\Windows Components\Internet Explorer\Prevent bypassing SmartScreen Filter warnings|Internet Explorer 8 or later|This policy setting determines whether an employee can bypass warnings from Microsoft Defender SmartScreen.

If you enable this policy setting, Microsoft Defender SmartScreen warnings block the employee.

If you disable or don't configure this policy setting, the employee can bypass Microsoft Defender SmartScreen warnings.| -|Administrative Templates\Windows Components\Internet Explorer\Prevent bypassing SmartScreen Filter warnings about files that aren't commonly downloaded from the Internet|Internet Explorer 9 or later|This policy setting determines whether the employee can bypass warnings from Microsoft Defender SmartScreen. Microsoft Defender SmartScreen warns the employee about executable files that Internet Explorer users don't commonly download from the Internet.

If you enable this policy setting, Microsoft Defender SmartScreen warnings block the employee.

If you disable or don't configure this policy setting, the employee can bypass Microsoft Defender SmartScreen warnings.| +|Setting|Description| +|---|--- | +|Administrative Templates > Windows Components > Windows Defender SmartScreen > Explorer > Configure Windows Defender SmartScreen | This policy setting turns on Microsoft Defender SmartScreen.

If you enable this setting, it turns on Microsoft Defender SmartScreen and your users are unable to turn it off. Additionally, when enabling this feature, you must also pick whether Microsoft Defender SmartScreen should Warn your users or Warn and prevent bypassing the message (effectively blocking the user from the site).

If you disable this setting, it turns off Microsoft Defender SmartScreen and your users are unable to turn it on.

If you don't configure this setting, your users can decide whether to use Microsoft Defender SmartScreen.| +|Administrative Templates > Windows Components > Windows Defender SmartScreen > Explorer > Configure App Install Control| This policy setting is intended to prevent malicious content from affecting your user's devices when downloading executable content from the internet.

This setting doesn't protect against malicious content from USB devices, network shares, or other non-internet sources.

**Important:** Using a trustworthy browser helps ensure that these protections work as expected.| +|Administrative Templates > Windows Components > Windows Defender SmartScreen > Microsoft Edge > Configure Windows Defender SmartScreen | This policy setting lets you configure whether to turn on Windows Defender SmartScreen. Windows Defender SmartScreen provides warning messages to help protect your users from potential phishing scams and malicious software. By default, Windows Defender SmartScreen is turned on.

If you enable this setting, Windows Defender SmartScreen is turned on, and users can't turn it off.

If you disable this setting, Windows Defender SmartScreen is turned off, and users can't turn it on.

If you don't configure this setting, users can choose whether to use Windows Defender SmartScreen. | +|Administrative Templates > Windows Components > Windows Defender SmartScreen > Microsoft Edge > Prevent bypassing Windows Defender SmartScreen prompts for sites | This policy setting lets you decide whether users can override the Windows Defender SmartScreen warnings about potentially malicious websites.

If you enable this setting, users can't ignore Windows Defender SmartScreen warnings and they're blocked from continuing to the site.

If you disable or don't configure this setting, users can ignore Windows Defender SmartScreen warnings and continue to the site. | ## MDM settings If you manage your policies using Microsoft Intune, use these MDM policy settings. All settings support desktop computers running Windows 10/11 Pro or Windows 10/11 Enterprise, enrolled with Microsoft Intune. -For Microsoft Defender SmartScreen Microsoft Edge MDM policies, see [Policy CSP - Browser](/windows/client-management/mdm/policy-csp-browser). - -|Setting|Supported versions|Details| -|--- |--- |--- | -|AllowSmartScreen|Windows 10|
  • **URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowSmartScreen
  • **Data type.** Integer
  • **Allowed values:**
    • **0 .** Turns off Microsoft Defender SmartScreen in Microsoft Edge.
    • **1.** Turns on Microsoft Defender SmartScreen in Microsoft Edge.| -|EnableAppInstallControl|Windows 10, version 1703|
    • **URI full path.** ./Vendor/MSFT/Policy/Config/SmartScreen/EnableAppInstallControl
    • **Data type.** Integer
    • **Allowed values:**
      • **0 .** Turns off Application Installation Control, allowing users to download and install files from anywhere on the web.
      • **1.** Turns on Application Installation Control, allowing users to install apps from the Microsoft Store only.| -|EnableSmartScreenInShell|Windows 10, version 1703|
      • **URI full path.** ./Vendor/MSFT/Policy/Config/SmartScreen/EnableSmartScreenInShell
      • **Data type.** Integer
      • **Allowed values:**
        • **0 .** Turns off Microsoft Defender SmartScreen in Windows for app and file execution.
        • **1.** Turns on Microsoft Defender SmartScreen in Windows for app and file execution.| -|PreventOverrideForFilesInShell|Windows 10, version 1703|
        • **URI full path.** ./Vendor/MSFT/Policy/Config/SmartScreen/PreventOverrideForFilesInShell
        • **Data type.** Integer
        • **Allowed values:**
          • **0 .** Employees can ignore Microsoft Defender SmartScreen warnings and run malicious files.
          • **1.** Employees can't ignore Microsoft Defender SmartScreen warnings and run malicious files.| -|PreventSmartScreenPromptOverride|Windows 10, Version 1511 and Windows 11|
          • **URI full path.** ./Vendor/MSFT/Policy/Config/Browser/PreventSmartscreenPromptOverride
          • **Data type.** Integer
          • **Allowed values:**
            • **0 .** Employees can ignore Microsoft Defender SmartScreen warnings.
            • **1.** Employees can't ignore Microsoft Defender SmartScreen warnings.| -|PreventSmartScreenPromptOverrideForFiles|Windows 10, Version 1511 and Windows 11|
            • **URI full path.** ./Vendor/MSFT/Policy/Config/Browser/PreventSmartScreenPromptOverrideForFiles
            • **Data type.** Integer
            • **Allowed values:**
              • **0 .** Employees can ignore Microsoft Defender SmartScreen warnings for files.
              • **1.** Employees can't ignore Microsoft Defender SmartScreen warnings for files.| +- [AllowSmartScreen](/windows/client-management/mdm/policy-csp-browser#allowsmartscreen) +- [EnableAppInstallControl](/windows/client-management/mdm/policy-csp-smartscreen.md#enableappinstallcontrol) +- [EnableSmartScreenInShell](/windows/client-management/mdm/policy-csp-smartscreen.md#enablesmartscreeninshell) +- [PreventOverrideForFilesInShell](/windows/client-management/mdm/policy-csp-smartscreen.md#preventoverrideforfilesinshell) +- [PreventSmartScreenPromptOverride](/windows/client-management/mdm/policy-csp-browser.md#preventsmartscreenpromptoverride) +- [PreventSmartScreenPromptOverrideForFiles](/windows/client-management/mdm/policy-csp-browser.md#preventsmartscreenpromptoverrideforfiles) ## Recommended Group Policy and MDM settings for your organization -By default, Microsoft Defender SmartScreen lets employees bypass warnings. Unfortunately, this feature can let employees continue to an unsafe site or to continue to download an unsafe file, even after being warned. Because of this possibility, we strongly recommend that you set up Microsoft Defender SmartScreen to block high-risk interactions instead of providing just a warning. +By default, Microsoft Defender SmartScreen lets users bypass warnings. Unfortunately, this feature can let users continue to an unsafe site or to continue to download an unsafe file, even after being warned. Because of this possibility, we strongly recommend that you set up Microsoft Defender SmartScreen to block high-risk interactions instead of providing just a warning. To better help you protect your organization, we recommend turning on and using these specific Microsoft Defender SmartScreen Group Policy and MDM settings. |Group Policy setting|Recommendation| |--- |--- | -|Administrative Templates\Windows Components\Microsoft Edge\Configure Windows Defender SmartScreen (Microsoft Edge version 45 and earlier)

                Administrative Templates\Microsoft Edge\SmartScreen settings\Configure Microsoft Defender SmartScreen (Microsoft Edge version 77 or later)|**Enable.** Turns on Microsoft Defender SmartScreen.| -|Administrative Templates\Windows Components\Microsoft Edge\Prevent bypassing Windows Defender SmartScreen prompts for sites (Microsoft Edge version 45 and earlier)

                Administrative Templates\Microsoft Edge\SmartScreen settings\Prevent bypassing Windows Defender SmartScreen prompts for sites (Microsoft Edge version 77 or later)|**Enable.** Stops employees from ignoring warning messages and continuing to a potentially malicious website.| -|Administrative Templates\Windows Components\Microsoft Edge\Prevent bypassing Windows Defender SmartScreen prompts for files (Microsoft Edge version 45 and earlier)

                Administrative Templates\Microsoft Edge\SmartScreen settings\Prevent bypassing of Microsoft Defender SmartScreen warnings about downloads (Microsoft Edge version 77 or later)|**Enable.** Stops employees from ignoring warning messages and continuing to download potentially malicious files.| -|Administrative Templates\Windows Components\File Explorer\Configure Windows Defender SmartScreen|**Enable with the Warn and prevent bypass option.** Stops employees from ignoring warning messages about malicious files downloaded from the Internet.| +|Administrative Templates > Windows Components > Microsoft Edge > Configure Windows Defender SmartScreen|**Enable.** Turns on Microsoft Defender SmartScreen.| +|Administrative Templates > Windows Components > Microsoft Edge > Prevent bypassing Windows Defender SmartScreen prompts for sites|**Enable.** Stops users from ignoring warning messages and continuing to a potentially malicious website.| +|Administrative Templates > Windows Components > Explorer > Configure Windows Defender SmartScreen|**Enable with the Warn and prevent bypass option.** Stops users from ignoring warning messages about malicious files downloaded from the Internet.| |MDM setting|Recommendation| |--- |--- | |Browser/AllowSmartScreen|**1.** Turns on Microsoft Defender SmartScreen.| -|Browser/PreventSmartScreenPromptOverride|**1.** Stops employees from ignoring warning messages and continuing to a potentially malicious website.| -|Browser/PreventSmartScreenPromptOverrideForFiles|**1.** Stops employees from ignoring warning messages and continuing to download potentially malicious files.| +|Browser/PreventSmartScreenPromptOverride|**1.** Stops users from ignoring warning messages and continuing to a potentially malicious website.| +|Browser/PreventSmartScreenPromptOverrideForFiles|**1.** Stops users from ignoring warning messages and continuing to download potentially malicious files.| |SmartScreen/EnableSmartScreenInShell|**1.** Turns on Microsoft Defender SmartScreen in Windows.

                Requires at least Windows 10, version 1703.| -|SmartScreen/PreventOverrideForFilesInShell|**1.** Stops employees from ignoring warning messages about malicious files downloaded from the Internet.

                Requires at least Windows 10, version 1703.| +|SmartScreen/PreventOverrideForFilesInShell|**1.** Stops users from ignoring warning messages about malicious files downloaded from the Internet.

                Requires at least Windows 10, version 1703.| ## Related articles diff --git a/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/enhanced-phishing-protection.md b/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/enhanced-phishing-protection.md index 38921c5358..b05b845919 100644 --- a/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/enhanced-phishing-protection.md +++ b/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/enhanced-phishing-protection.md @@ -1,7 +1,7 @@ --- title: Enhanced Phishing Protection in Microsoft Defender SmartScreen description: Learn how Enhanced Phishing Protection for Microsoft Defender SmartScreen helps protect Microsoft school or work passwords against phishing and unsafe usage on sites and apps. -ms.date: 11/02/2023 +ms.date: 07/10/2024 ms.topic: conceptual appliesto: - βœ… Windows 11, version 22H2 @@ -37,7 +37,7 @@ Enhanced Phishing Protection provides robust phishing protections for work or sc ## Configure Enhanced Phishing Protection for your organization -Enhanced Phishing Protection can be configured via Microsoft Intune, Group Policy Objects (GPO) or Configuration Service Providers (CSP) with an MDM service. These settings are available to configure your devices using either Microsoft Intune, GPO or CSP. +Enhanced Phishing Protection can be configured via Microsoft Intune, Group Policy Objects (GPO) or Configuration Service Providers (CSP) with an MDM service. These settings are available to configure your devices using either Microsoft Intune, GPO, or CSP. | Setting | Description | |--|--| @@ -51,7 +51,7 @@ Enhanced Phishing Protection allows organizations to add their custom identity p To add your organization's custom sign-in URL to Enhanced Phishing Protection, configure the `EnableWebSignIn` policy in the [Authentication Policy CSP](/windows/client-management/mdm/policy-csp-authentication#enablewebsignin). For more information, see [Web sign-in for Windows](../../../identity-protection/web-sign-in/index.md). -Follow these instructions to configure your devices using either Microsoft Intune, GPO or CSP. +Follow these instructions to configure your devices using either Microsoft Intune, GPO, or CSP. #### [:::image type="icon" source="../../../images/icons/intune.svg"::: **Intune**](#tab/intune) diff --git a/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/index.md b/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/index.md index b5af241045..56fc48b2bf 100644 --- a/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/index.md +++ b/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/index.md @@ -1,7 +1,7 @@ --- title: Microsoft Defender SmartScreen overview description: Learn how Microsoft Defender SmartScreen protects against phishing or malware websites and applications, and the downloading of potentially malicious files. -ms.date: 08/11/2023 +ms.date: 07/10/2024 ms.topic: conceptual appliesto: - βœ… Windows 11 From 0f97bb0b4781aea4636fb288201e6d4caa9bf036 Mon Sep 17 00:00:00 2001 From: "Vinay Pamnani (from Dev Box)" Date: Wed, 10 Jul 2024 16:56:53 -0600 Subject: [PATCH 30/41] Fix links --- .../available-settings.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/available-settings.md b/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/available-settings.md index a416410eb0..3d92583855 100644 --- a/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/available-settings.md +++ b/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/available-settings.md @@ -29,11 +29,11 @@ SmartScreen uses registry-based Administrative Template policy settings. If you manage your policies using Microsoft Intune, use these MDM policy settings. All settings support desktop computers running Windows 10/11 Pro or Windows 10/11 Enterprise, enrolled with Microsoft Intune. - [AllowSmartScreen](/windows/client-management/mdm/policy-csp-browser#allowsmartscreen) -- [EnableAppInstallControl](/windows/client-management/mdm/policy-csp-smartscreen.md#enableappinstallcontrol) -- [EnableSmartScreenInShell](/windows/client-management/mdm/policy-csp-smartscreen.md#enablesmartscreeninshell) -- [PreventOverrideForFilesInShell](/windows/client-management/mdm/policy-csp-smartscreen.md#preventoverrideforfilesinshell) -- [PreventSmartScreenPromptOverride](/windows/client-management/mdm/policy-csp-browser.md#preventsmartscreenpromptoverride) -- [PreventSmartScreenPromptOverrideForFiles](/windows/client-management/mdm/policy-csp-browser.md#preventsmartscreenpromptoverrideforfiles) +- [EnableAppInstallControl](/windows/client-management/mdm/policy-csp-smartscreen#enableappinstallcontrol) +- [EnableSmartScreenInShell](/windows/client-management/mdm/policy-csp-smartscreen#enablesmartscreeninshell) +- [PreventOverrideForFilesInShell](/windows/client-management/mdm/policy-csp-smartscreen#preventoverrideforfilesinshell) +- [PreventSmartScreenPromptOverride](/windows/client-management/mdm/policy-csp-browser#preventsmartscreenpromptoverride) +- [PreventSmartScreenPromptOverrideForFiles](/windows/client-management/mdm/policy-csp-browser#preventsmartscreenpromptoverrideforfiles) ## Recommended Group Policy and MDM settings for your organization From a2a1479ccd2497e627f6a3fe14c025086bffa0c3 Mon Sep 17 00:00:00 2001 From: "Vinay Pamnani (from Dev Box)" Date: Thu, 11 Jul 2024 10:17:23 -0600 Subject: [PATCH 31/41] Mo-updates --- .../microsoft-defender-smartscreen/available-settings.md | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/available-settings.md b/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/available-settings.md index 3d92583855..d53d8c5dc7 100644 --- a/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/available-settings.md +++ b/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/available-settings.md @@ -4,7 +4,8 @@ description: A list of all available settings for Microsoft Defender SmartScreen ms.date: 07/10/2024 ms.topic: reference --- -# Available Microsoft Defender SmartScreen Group Policy and mobile device management (MDM) settings + +# Available Microsoft Defender SmartScreen settings Microsoft Defender SmartScreen works with Intune, Group Policy, and mobile device management (MDM) settings to help you manage your organization's computer settings. Based on how you set up Microsoft Defender SmartScreen, you can show users a warning page and let them continue to the site, or you can block the site entirely. @@ -54,7 +55,3 @@ To better help you protect your organization, we recommend turning on and using |Browser/PreventSmartScreenPromptOverrideForFiles|**1.** Stops users from ignoring warning messages and continuing to download potentially malicious files.| |SmartScreen/EnableSmartScreenInShell|**1.** Turns on Microsoft Defender SmartScreen in Windows.

                Requires at least Windows 10, version 1703.| |SmartScreen/PreventOverrideForFilesInShell|**1.** Stops users from ignoring warning messages about malicious files downloaded from the Internet.

                Requires at least Windows 10, version 1703.| - -## Related articles - -- [Available Group Policy and Mobile Device Management (MDM) settings for Microsoft Edge](/microsoft-edge/deploy/available-policies) From 54d1e68b88c58b36cda16851943074c306a5dc06 Mon Sep 17 00:00:00 2001 From: Jeff Borsecnik <123032460+American-Dipper@users.noreply.github.com> Date: Thu, 11 Jul 2024 10:00:29 -0700 Subject: [PATCH 32/41] Update enhanced-phishing-protection.md - Acrolinx fix --- .../enhanced-phishing-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/enhanced-phishing-protection.md b/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/enhanced-phishing-protection.md index b05b845919..ee7a31a01b 100644 --- a/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/enhanced-phishing-protection.md +++ b/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/enhanced-phishing-protection.md @@ -19,7 +19,7 @@ If a user signs into Windows using a password, Enhanced Phishing Protection work - If users type their work or school password into a website or app that SmartScreen finds suspicious, Enhanced Phishing Protection can automatically collect information from that website or app to help identify security threats. For example, the content displayed, sounds played, and application memory. > [!NOTE] -> When a user signs-in to a device using a Windows Hello for Business PIN or biometric, Enhanced Phishing Protection does not alert the user or send events to [Microsoft Defender for Endpoint (MDE)](/microsoft-365/security/defender-endpoint/). +> When a user signs in to a device using a Windows Hello for Business PIN or biometric, Enhanced Phishing Protection does not alert the user or send events to [Microsoft Defender for Endpoint (MDE)](/microsoft-365/security/defender-endpoint/). ## Benefits of Enhanced Phishing Protection in Microsoft Defender SmartScreen From 569105a82dbacc043628c25c38df225e20930e01 Mon Sep 17 00:00:00 2001 From: Jeff Borsecnik <123032460+American-Dipper@users.noreply.github.com> Date: Thu, 11 Jul 2024 10:01:32 -0700 Subject: [PATCH 33/41] Update protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md - Acrolinx fix --- ...ets-by-controlling-the-health-of-windows-10-based-devices.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/operating-system-security/system-security/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md b/windows/security/operating-system-security/system-security/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md index 7cad827253..1c997805c4 100644 --- a/windows/security/operating-system-security/system-security/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md +++ b/windows/security/operating-system-security/system-security/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md @@ -329,7 +329,7 @@ The following table details the hardware requirements for both Virtualization-ba |IOMMU, such as Intel VT-d, AMD-Vi|Support for the IOMMU in Windows enhances system resiliency against DMA attacks.| |Trusted Platform Module (TPM)|Required to support health attestation and necessary for other key protections for Virtualization-based security. TPM 2.0 is supported. Support for TPM 1.2 was added beginning in Windows 10, version 1607 (RS1)| -This section presented information about several closely related controls in Windows . The multi-layer defenses and in-depth approach help to eradicate low-level malware during boot sequence. Virtualization-based security is a fundamental operating system architecture change that adds a new security boundary. Device Guard and Credential Guard respectively help to block untrusted code and protect corporate domain credentials from theft and reuse. This section also briefly discussed the importance of managing devices and patching vulnerabilities. All these technologies can be used to harden and lock down devices while limiting the risk of attackers compromising them. +This section presented information about several closely related controls in Windows. The multi-layer defenses and in-depth approach help to eradicate low-level malware during boot sequence. Virtualization-based security is a fundamental operating system architecture change that adds a new security boundary. Device Guard and Credential Guard respectively help to block untrusted code and protect corporate domain credentials from theft and reuse. This section also briefly discussed the importance of managing devices and patching vulnerabilities. All these technologies can be used to harden and lock down devices while limiting the risk of attackers compromising them. ## Detect an unhealthy Windows-based device From d11d590f4668d92a007f44b4fbf18ac5d0febfbb Mon Sep 17 00:00:00 2001 From: Aaron Czechowski Date: Thu, 11 Jul 2024 16:04:49 -0700 Subject: [PATCH 34/41] remove essentials-overview --- windows/deployment/do/waas-delivery-optimization.md | 5 ++--- .../windows-autopatch/overview/windows-autopatch-overview.md | 3 +-- .../windows-defender-application-control/wdac.md | 3 --- windows/security/introduction.md | 1 - 4 files changed, 3 insertions(+), 9 deletions(-) diff --git a/windows/deployment/do/waas-delivery-optimization.md b/windows/deployment/do/waas-delivery-optimization.md index 10e0059d41..133945930d 100644 --- a/windows/deployment/do/waas-delivery-optimization.md +++ b/windows/deployment/do/waas-delivery-optimization.md @@ -11,11 +11,10 @@ ms.reviewer: mstewart ms.collection: - tier3 - highpri - - essentials-overview ms.localizationpriority: medium -appliesto: +appliesto: - βœ… Windows 11 -- βœ… Windows 10 +- βœ… Windows 10 ms.date: 05/23/2024 --- diff --git a/windows/deployment/windows-autopatch/overview/windows-autopatch-overview.md b/windows/deployment/windows-autopatch/overview/windows-autopatch-overview.md index f5f9d6ac76..f8f71f9db2 100644 --- a/windows/deployment/windows-autopatch/overview/windows-autopatch-overview.md +++ b/windows/deployment/windows-autopatch/overview/windows-autopatch-overview.md @@ -4,7 +4,7 @@ description: Details what the service is and shortcuts to articles. ms.date: 07/08/2024 ms.service: windows-client ms.subservice: itpro-updates -ms.topic: conceptual +ms.topic: overview ms.localizationpriority: medium author: tiaraquan ms.author: tiaraquan @@ -12,7 +12,6 @@ manager: aaroncz ms.collection: - highpri - tier1 - - essentials-overview ms.reviewer: hathind --- diff --git a/windows/security/application-security/application-control/windows-defender-application-control/wdac.md b/windows/security/application-security/application-control/windows-defender-application-control/wdac.md index f35be85ec0..2d0145d3bc 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/wdac.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/wdac.md @@ -4,9 +4,6 @@ description: Application Control restricts which applications users are allowed ms.localizationpriority: medium ms.collection: - tier3 -- must-keep -- essentials-navigation -- essentials-overview ms.date: 08/30/2023 ms.topic: overview --- diff --git a/windows/security/introduction.md b/windows/security/introduction.md index 7b90b57e21..073a4309b9 100644 --- a/windows/security/introduction.md +++ b/windows/security/introduction.md @@ -6,7 +6,6 @@ ms.topic: tutorial ms.author: paoloma ms.collection: - essentials-security - - essentials-overview content_well_notification: - AI-contribution author: paolomatarazzo From 2bf1e76a2e66999da2eb46399288f605ceeddce2 Mon Sep 17 00:00:00 2001 From: Aaron Czechowski Date: Thu, 11 Jul 2024 16:05:00 -0700 Subject: [PATCH 35/41] remove essentials-navigation --- education/windows/index.yml | 1 - windows/deployment/do/index.yml | 11 +++++------ windows/deployment/windows-autopatch/index.yml | 1 - windows/security/index.yml | 1 - 4 files changed, 5 insertions(+), 9 deletions(-) diff --git a/education/windows/index.yml b/education/windows/index.yml index ac12ab0836..0cd20e659d 100644 --- a/education/windows/index.yml +++ b/education/windows/index.yml @@ -9,7 +9,6 @@ metadata: ms.collection: - education - tier1 - - essentials-navigation author: paolomatarazzo ms.author: paoloma manager: aaroncz diff --git a/windows/deployment/do/index.yml b/windows/deployment/do/index.yml index d4f3409ae7..d8717e04d8 100644 --- a/windows/deployment/do/index.yml +++ b/windows/deployment/do/index.yml @@ -12,13 +12,12 @@ metadata: ms.collection: - highpri - tier3 - - essentials-navigation author: aczechowski ms.author: aaroncz manager: aaroncz ms.date: 12/22/2023 #Required; mm/dd/yyyy format. localization_priority: medium - + # linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | tutorial | video | whats-new landingContent: @@ -61,8 +60,8 @@ landingContent: - text: Optimize Windows 10 or later update delivery with Configuration Manager url: /mem/configmgr/sum/deploy-use/optimize-windows-10-update-delivery#windows-delivery-optimization - text: Delivery Optimization settings in Microsoft Intune - url: /mem/intune/configuration/delivery-optimization-windows - + url: /mem/intune/configuration/delivery-optimization-windows + # Card - title: Microsoft Connected Cache (MCC) for Enterprise and Education linkLists: @@ -71,7 +70,7 @@ landingContent: - text: MCC for Enterprise and Education (early preview) url: waas-microsoft-connected-cache.md - text: Sign up - url: https://aka.ms/MSConnectedCacheSignup + url: https://aka.ms/MSConnectedCacheSignup # Card - title: Microsoft Connected Cache (MCC) for Internet Service Providers (ISPs) @@ -84,7 +83,7 @@ landingContent: url: https://aka.ms/MCCForISPSurvey - text: MCC for ISPs (early preview) url: mcc-isp.md - + # Card (optional) - title: Resources diff --git a/windows/deployment/windows-autopatch/index.yml b/windows/deployment/windows-autopatch/index.yml index 2c2a7c6642..3385e19bee 100644 --- a/windows/deployment/windows-autopatch/index.yml +++ b/windows/deployment/windows-autopatch/index.yml @@ -17,7 +17,6 @@ metadata: ms.collection: - highpri - tier2 - - essentials-navigation # linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | sample | tutorial | video | whats-new diff --git a/windows/security/index.yml b/windows/security/index.yml index afb32d0f77..9553388f93 100644 --- a/windows/security/index.yml +++ b/windows/security/index.yml @@ -7,7 +7,6 @@ metadata: ms.topic: landing-page ms.collection: - tier1 - - essentials-navigation author: paolomatarazzo ms.author: paoloma manager: aaroncz From 73cb07bebf5e3035f8d554c290c603c486a53dd1 Mon Sep 17 00:00:00 2001 From: Aaron Czechowski Date: Thu, 11 Jul 2024 16:06:50 -0700 Subject: [PATCH 36/41] remove essentials accountability tags --- .../deployment/do/delivery-optimization-workflow.md | 12 +++++------- .../overview/windows-autopatch-privacy.md | 1 - 2 files changed, 5 insertions(+), 8 deletions(-) diff --git a/windows/deployment/do/delivery-optimization-workflow.md b/windows/deployment/do/delivery-optimization-workflow.md index 9635f725c9..1f89eca0a6 100644 --- a/windows/deployment/do/delivery-optimization-workflow.md +++ b/windows/deployment/do/delivery-optimization-workflow.md @@ -8,15 +8,13 @@ author: cmknox ms.author: carmenf manager: aaroncz ms.reviewer: mstewart -ms.collection: +ms.collection: - tier3 - - essentials-privacy - - essentials-security ms.localizationpriority: medium -appliesto: +appliesto: - βœ… Windows 11 - βœ… Windows 10 -- βœ… Delivery Optimization +- βœ… Delivery Optimization ms.date: 05/23/2024 --- @@ -30,7 +28,7 @@ Delivery Optimization can't be used to download or send personal content. Delive Delivery Optimization downloads the same updates and apps that you would get through [Windows Update](../update/windows-update-security.md), Microsoft Store apps, and other Microsoft updates using the same security measures. To make sure you're getting authentic updates, Delivery Optimization gets information securely from Microsoft to check the authenticity of each part of an update or app that it downloads from other PCs. The authenticity of the downloads is checked again before installing it. -## Download request workflow +## Download request workflow This workflow allows Delivery Optimization to securely and efficiently deliver requested content to the calling device and explains client-service communication. Delivery Optimization uses content metadata to verify the content and to determine all available locations to pull content from. @@ -50,4 +48,4 @@ This workflow allows Delivery Optimization to securely and efficiently deliver r | cp\*.prod.do.dsp.mp.microsoft.com
                | 443 | Content Policy | Provides content specific policies and as content metadata URLs. | **Profile**: The device type (for example, PC or Xbox)
                **ContentId**: The content identifier
                **doClientVersion**: The version of the DoSvc client
                **countryCode**: The country the client is connected from
                **altCatalogID**: If ContentID isn't available, use the download URL instead
                **eID**: Client grouping ID
                **CacheHost**: Cache host ID | | disc\*.prod.do.dsp.mp.microsoft.com | 443 | Discovery | Directs clients to a particular instance of the peer matching service (Array), ensuing that clients are collocated by factors, such as content, groupID and external IP. | **Profile**: The device type (for example, PC or Xbox)
                **ContentID**: The content identifier
                **doClientVersion**: The version of the DoSvc client
                **partitionID**: Client partitioning hint
                **altCatalogID**: If ContentID isn't available, use the download URL instead
                **eID**: Client grouping ID | | array\*.prod.do.dsp.mp.microsoft.com | 443 | Arrays | Provides the client with list of peers that have the same content and belong to the same peer group. | **Profile**: The device type (for example, PC or Xbox)
                **ContentID**: The content identifier
                **doClientVersion**: The version of the DoSvc client
                **altCatalogID**: If ContentID isn't available, use the download URL instead
                **PeerID**: Identity of the device running DO client
                **ReportedIp**: The internal / private IP Address
                **IsBackground**: Is the download interactive or background
                **Uploaded**: Total bytes uploaded to peers
                **Downloaded**: Total bytes downloaded from peers
                **DownloadedCdn**: Total bytes downloaded from CDN
                **Left**: Bytes left to download
                **Peers Wanted**: Total number of peers wanted
                **Group ID**: Group the device belongs to (set via DownloadMode 2 + Group ID GP / MDM policies)
                **Scope**: The Download mode
                **UploadedBPS**: The upload speed in bytes per second
                **DownloadBPS**: The download speed in Bytes per second
                **eID**: Client grouping ID | -| dl.delivery.mp.microsoft.com
                download.windowsupdate.com | 80 | Delivery Optimization metadata file hosting | CDN hostnames for Delivery Optimization content metadata files | Metadata download can come from different hostnames, but it's required for peer to peer. | +| dl.delivery.mp.microsoft.com
                download.windowsupdate.com | 80 | Delivery Optimization metadata file hosting | CDN hostnames for Delivery Optimization content metadata files | Metadata download can come from different hostnames, but it's required for peer to peer. | diff --git a/windows/deployment/windows-autopatch/overview/windows-autopatch-privacy.md b/windows/deployment/windows-autopatch/overview/windows-autopatch-privacy.md index 5b74de7688..c2aadef998 100644 --- a/windows/deployment/windows-autopatch/overview/windows-autopatch-privacy.md +++ b/windows/deployment/windows-autopatch/overview/windows-autopatch-privacy.md @@ -13,7 +13,6 @@ ms.reviewer: hathind ms.collection: - highpri - tier1 - - essentials-privacy --- # Privacy From 8b74ed138a34c9ad40cacac197577e3e486c7c3d Mon Sep 17 00:00:00 2001 From: Aaron Czechowski Date: Thu, 11 Jul 2024 16:07:39 -0700 Subject: [PATCH 37/41] remove essentials-get-started --- windows/deployment/do/waas-delivery-optimization-setup.md | 1 - .../overview/windows-autopatch-deployment-guide.md | 1 - .../deployment/wdac-deployment-guide.md | 3 +-- 3 files changed, 1 insertion(+), 4 deletions(-) diff --git a/windows/deployment/do/waas-delivery-optimization-setup.md b/windows/deployment/do/waas-delivery-optimization-setup.md index 0a8cced507..93e5197724 100644 --- a/windows/deployment/do/waas-delivery-optimization-setup.md +++ b/windows/deployment/do/waas-delivery-optimization-setup.md @@ -10,7 +10,6 @@ ms.reviewer: mstewart manager: aaroncz ms.collection: - tier3 - - essentials-get-started ms.localizationpriority: medium appliesto: - βœ… Windows 11 diff --git a/windows/deployment/windows-autopatch/overview/windows-autopatch-deployment-guide.md b/windows/deployment/windows-autopatch/overview/windows-autopatch-deployment-guide.md index df3a6cd77d..a44081d038 100644 --- a/windows/deployment/windows-autopatch/overview/windows-autopatch-deployment-guide.md +++ b/windows/deployment/windows-autopatch/overview/windows-autopatch-deployment-guide.md @@ -12,7 +12,6 @@ manager: aaroncz ms.reviewer: hathind ms.collection: - tier2 - - essentials-get-started --- # Windows Autopatch deployment guide diff --git a/windows/security/application-security/application-control/windows-defender-application-control/deployment/wdac-deployment-guide.md b/windows/security/application-security/application-control/windows-defender-application-control/deployment/wdac-deployment-guide.md index 21442ea394..46d07c19a7 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/deployment/wdac-deployment-guide.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/deployment/wdac-deployment-guide.md @@ -4,7 +4,6 @@ description: Learn how to plan and implement a WDAC deployment. ms.localizationpriority: medium ms.date: 01/23/2023 ms.topic: overview -ms.collection: essentials-get-started --- # Deploying Windows Defender Application Control (WDAC) policies @@ -31,7 +30,7 @@ Before you deploy your WDAC policies, you must first convert the XML to its bina { $PolicyBinary = "SiPolicy.p7b" } - + ## Binary file will be written to your desktop ConvertFrom-CIPolicy -XmlFilePath $WDACPolicyXMLFile -BinaryFilePath $env:USERPROFILE\Desktop\$PolicyBinary ``` From 77f3216934c59c1c797c319b09699f53233449a5 Mon Sep 17 00:00:00 2001 From: Aaron Czechowski Date: Thu, 11 Jul 2024 16:09:15 -0700 Subject: [PATCH 38/41] remove essentials-manage --- windows/deployment/do/waas-delivery-optimization-monitor.md | 5 ++--- .../operate/windows-autopatch-groups-update-management.md | 1 - .../operate/windows-autopatch-maintain-environment.md | 1 - .../windows-autopatch-policy-health-and-remediation.md | 1 - .../operations/wdac-operational-guide.md | 1 - 5 files changed, 2 insertions(+), 7 deletions(-) diff --git a/windows/deployment/do/waas-delivery-optimization-monitor.md b/windows/deployment/do/waas-delivery-optimization-monitor.md index 6c30ab2dc4..ed6710932b 100644 --- a/windows/deployment/do/waas-delivery-optimization-monitor.md +++ b/windows/deployment/do/waas-delivery-optimization-monitor.md @@ -10,11 +10,10 @@ manager: aaroncz ms.reviewer: mstewart ms.collection: - tier3 - - essentials-manage ms.localizationpriority: medium -appliesto: +appliesto: - βœ… Windows 11 -- βœ… Windows 10 +- βœ… Windows 10 - βœ… Delivery Optimization ms.date: 05/23/2024 --- diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-update-management.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-update-management.md index ee20c918b3..1a03d4c08b 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-update-management.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-update-management.md @@ -13,7 +13,6 @@ ms.reviewer: andredm7 ms.collection: - highpri - tier1 - - essentials-manage --- # Software update management diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-maintain-environment.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-maintain-environment.md index 0b6c9d7421..6273ceb86d 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-maintain-environment.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-maintain-environment.md @@ -13,7 +13,6 @@ ms.reviewer: smithcharles ms.collection: - highpri - tier1 - - essentials-manage --- # Maintain the Windows Autopatch environment diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-policy-health-and-remediation.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-policy-health-and-remediation.md index 54d541524e..16dd0cc679 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-policy-health-and-remediation.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-policy-health-and-remediation.md @@ -13,7 +13,6 @@ ms.reviewer: rekhanr ms.collection: - highpri - tier1 - - essentials-manage --- # Policy health and remediation diff --git a/windows/security/application-security/application-control/windows-defender-application-control/operations/wdac-operational-guide.md b/windows/security/application-security/application-control/windows-defender-application-control/operations/wdac-operational-guide.md index 81a98c78ca..71c48fb256 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/operations/wdac-operational-guide.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/operations/wdac-operational-guide.md @@ -4,7 +4,6 @@ description: Gather information about how your deployed Windows Defender Applica ms.localizationpriority: medium ms.date: 03/30/2023 ms.topic: how-to -ms.collection: essentials-manage --- # Windows Defender Application Control operational guide From 9f331ad29a241262cfcb2ede014dbd1cb2de837b Mon Sep 17 00:00:00 2001 From: Aaron Czechowski Date: Thu, 11 Jul 2024 16:15:55 -0700 Subject: [PATCH 39/41] add essentials-manage --- .../client-tools/administrative-tools-in-windows.md | 2 ++ windows/client-management/index.yml | 1 + windows/client-management/mdm-overview.md | 1 + windows/configuration/start/index.md | 2 ++ windows/configuration/taskbar/index.md | 2 ++ 5 files changed, 8 insertions(+) diff --git a/windows/client-management/client-tools/administrative-tools-in-windows.md b/windows/client-management/client-tools/administrative-tools-in-windows.md index 63b3fbd65c..785eb740cc 100644 --- a/windows/client-management/client-tools/administrative-tools-in-windows.md +++ b/windows/client-management/client-tools/administrative-tools-in-windows.md @@ -4,6 +4,8 @@ description: The folders for Windows Tools and Administrative Tools are folders ms.date: 07/01/2024 ms.topic: conceptual zone_pivot_groups: windows-versions-11-10 +ms.collection: +- essentials-manage --- # Windows Tools diff --git a/windows/client-management/index.yml b/windows/client-management/index.yml index 184e34da03..4cee76e2bb 100644 --- a/windows/client-management/index.yml +++ b/windows/client-management/index.yml @@ -10,6 +10,7 @@ metadata: ms.collection: - highpri - tier1 + - essentials-manage author: vinaypamnani-msft ms.author: vinpa manager: aaroncz diff --git a/windows/client-management/mdm-overview.md b/windows/client-management/mdm-overview.md index 7be2352c9b..1db4cb2fee 100644 --- a/windows/client-management/mdm-overview.md +++ b/windows/client-management/mdm-overview.md @@ -7,6 +7,7 @@ ms.localizationpriority: medium ms.collection: - highpri - tier2 +- essentials-manage --- # Mobile Device Management overview diff --git a/windows/configuration/start/index.md b/windows/configuration/start/index.md index c78ef0401d..0627e33663 100644 --- a/windows/configuration/start/index.md +++ b/windows/configuration/start/index.md @@ -4,6 +4,8 @@ description: Learn how to configure the Windows Start menu to provide quick acce ms.topic: overview ms.date: 04/10/2024 zone_pivot_groups: windows-versions-11-10 +ms.collection: +- essentials-manage appliesto: --- diff --git a/windows/configuration/taskbar/index.md b/windows/configuration/taskbar/index.md index 68edd41929..6ef2fe06f6 100644 --- a/windows/configuration/taskbar/index.md +++ b/windows/configuration/taskbar/index.md @@ -3,6 +3,8 @@ title: Configure the Windows taskbar description: Learn how to configure the Windows taskbar to provide quick access to the tools and applications that users need most. ms.topic: how-to ms.date: 04/17/2024 +ms.collection: +- essentials-manage appliesto: zone_pivot_groups: windows-versions-11-10 --- From 3288894552c9af09566cfad6a39e781c6d16938a Mon Sep 17 00:00:00 2001 From: Aaron Czechowski Date: Thu, 11 Jul 2024 16:22:19 -0700 Subject: [PATCH 40/41] update hub page --- windows/hub/index.yml | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/windows/hub/index.yml b/windows/hub/index.yml index 6bed7b9fcc..48104903e4 100644 --- a/windows/hub/index.yml +++ b/windows/hub/index.yml @@ -15,7 +15,7 @@ metadata: author: paolomatarazzo ms.author: paoloma manager: aaroncz - ms.date: 04/25/2024 + ms.date: 07/11/2024 highlightedContent: items: @@ -34,9 +34,9 @@ highlightedContent: - title: Windows commercial licensing itemType: overview url: /windows/whats-new/windows-licensing - - title: Copilot in Windows + - title: Manage Recall itemType: how-to-guide - url: /windows/client-management/manage-windows-copilot + url: /windows/client-management/manage-recall - title: Windows 365 documentation itemType: overview url: /windows-365 @@ -55,10 +55,10 @@ productDirectory: - title: Learn how to deploy Windows imageSrc: /media/common/i_deploy.svg links: - - url: /mem/autopilot/ - text: Windows Autopilot overview - - url: /mem/autopilot/tutorial/autopilot-scenarios - text: "Tutorial: Windows Autopilot scenarios" + - url: /autopilot/ + text: Windows Autopilot + - url: /autopilot/device-preparation/compare + text: Compare Windows Autopilot solutions - url: /windows/deployment/do/ text: Delivery optimization - url: /windows/deployment/update/deployment-service-overview @@ -109,8 +109,8 @@ productDirectory: text: Configuration Service Provider (CSP) - url: /windows/client-management/administrative-tools-in-windows-10 text: Windows administrative tools - - url: /windows/client-management/manage-windows-copilot - text: Manage Copilot in Windows + - url: /windows/client-management/manage-recall + text: Manage Recall - url: /windows/application-management/index text: Learn more about application management > - url: /windows/client-management From b14ef2b4bb9f5bc975145c730ab0c2cef4e5ed8b Mon Sep 17 00:00:00 2001 From: Aaron Czechowski Date: Fri, 12 Jul 2024 10:08:34 -0700 Subject: [PATCH 41/41] update tiles --- windows/hub/index.yml | 20 ++++++++------------ 1 file changed, 8 insertions(+), 12 deletions(-) diff --git a/windows/hub/index.yml b/windows/hub/index.yml index 48104903e4..95d49b10a7 100644 --- a/windows/hub/index.yml +++ b/windows/hub/index.yml @@ -34,19 +34,15 @@ highlightedContent: - title: Windows commercial licensing itemType: overview url: /windows/whats-new/windows-licensing - - title: Manage Recall - itemType: how-to-guide - url: /windows/client-management/manage-recall - title: Windows 365 documentation itemType: overview url: /windows-365 - title: Explore all Windows trainings and learning paths for IT pros itemType: learn url: https://learn.microsoft.com/en-us/training/browse/?products=windows&roles=administrator - -# - title: Enroll Windows client devices in Microsoft Intune -# itemType: how-to-guide -# url: /mem/intune/fundamentals/deployment-guide-enrollment-windows + - title: Enroll Windows client devices in Microsoft Intune + itemType: how-to-guide + url: /mem/intune/fundamentals/deployment-guide-enrollment-windows productDirectory: title: Get started @@ -103,14 +99,14 @@ productDirectory: - title: Learn how to manage Windows imageSrc: /media/common/i_management.svg links: + - url: /windows/client-management/administrative-tools-in-windows-10 + text: Windows administrative tools + - url: /windows/client-management/client-tools/windows-version-search + text: What version of Windows am I running? - url: /windows/client-management/mobile-device-enrollment text: MDM enrollment - url: /windows/client-management/mdm/ - text: Configuration Service Provider (CSP) - - url: /windows/client-management/administrative-tools-in-windows-10 - text: Windows administrative tools - - url: /windows/client-management/manage-recall - text: Manage Recall + text: Configuration Service Provider (CSP) reference - url: /windows/application-management/index text: Learn more about application management > - url: /windows/client-management