From 83932149e53c8a15bd96850a50cbaf6c3c1e2ccf Mon Sep 17 00:00:00 2001
From: "Vinay Pamnani (from Dev Box)"
Date: Tue, 14 Jan 2025 16:45:06 -0700
Subject: [PATCH 01/86] December DDF updates
---
.../mdm/healthattestation-csp.md | 4 +-
.../mdm/healthattestation-ddf.md | 4 +-
.../mdm/policies-in-preview.md | 17 +-
.../mdm/policy-csp-connectivity.md | 57 +++++-
.../mdm/policy-csp-deliveryoptimization.md | 58 +++---
.../mdm/policy-csp-deviceguard.md | 68 ++++++-
.../mdm/policy-csp-humanpresence.md | 181 +++++++++++++++++-
.../mdm/policy-csp-printers.md | 54 +++++-
windows/client-management/mdm/vpnv2-csp.md | 14 +-
.../client-management/mdm/vpnv2-ddf-file.md | 12 +-
10 files changed, 415 insertions(+), 54 deletions(-)
diff --git a/windows/client-management/mdm/healthattestation-csp.md b/windows/client-management/mdm/healthattestation-csp.md
index 4367d3cb2f..a43aae095f 100644
--- a/windows/client-management/mdm/healthattestation-csp.md
+++ b/windows/client-management/mdm/healthattestation-csp.md
@@ -1,7 +1,7 @@
---
title: HealthAttestation CSP
description: Learn more about the HealthAttestation CSP.
-ms.date: 01/31/2024
+ms.date: 01/14/2025
---
@@ -51,7 +51,7 @@ The following list shows the HealthAttestation configuration service provider no
| Scope | Editions | Applicable OS |
|:--|:--|:--|
-| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
+| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5046732](https://support.microsoft.com/help/5046732) [10.0.22621.4541] and later
✅ Windows 11, version 24H2 with [KB5046617](https://support.microsoft.com/help/5046617) [10.0.26100.2314] and later
✅ Windows Insider Preview |
diff --git a/windows/client-management/mdm/healthattestation-ddf.md b/windows/client-management/mdm/healthattestation-ddf.md
index 0c9d382872..5a273aecc4 100644
--- a/windows/client-management/mdm/healthattestation-ddf.md
+++ b/windows/client-management/mdm/healthattestation-ddf.md
@@ -1,7 +1,7 @@
---
title: HealthAttestation DDF file
description: View the XML file containing the device description framework (DDF) for the HealthAttestation configuration service provider.
-ms.date: 06/28/2024
+ms.date: 01/14/2025
---
@@ -436,7 +436,7 @@ The following XML file contains the device description framework (DDF) for the H
- 99.9.99999
+ 99.9.99999, 10.0.26100.2314, 10.0.22621.4541
1.4
diff --git a/windows/client-management/mdm/policies-in-preview.md b/windows/client-management/mdm/policies-in-preview.md
index 0e4249d643..a728e43011 100644
--- a/windows/client-management/mdm/policies-in-preview.md
+++ b/windows/client-management/mdm/policies-in-preview.md
@@ -1,7 +1,7 @@
---
title: Configuration service provider preview policies
description: Learn more about configuration service provider (CSP) policies that are available for Windows Insider Preview.
-ms.date: 11/27/2024
+ms.date: 01/14/2025
---
@@ -31,6 +31,7 @@ This article lists the policies that are applicable for Windows Insider Preview
## Connectivity
+- [DisableCrossDeviceResume](policy-csp-connectivity.md#disablecrossdeviceresume)
- [UseCellularWhenWiFiPoor](policy-csp-connectivity.md#usecellularwhenwifipoor)
- [DisableCellularSettingsPage](policy-csp-connectivity.md#disablecellularsettingspage)
- [DisableCellularOperatorSettingsPage](policy-csp-connectivity.md#disablecellularoperatorsettingspage)
@@ -46,6 +47,10 @@ This article lists the policies that are applicable for Windows Insider Preview
- [DODisallowCacheServerDownloadsOnVPN](policy-csp-deliveryoptimization.md#dodisallowcacheserverdownloadsonvpn)
- [DOVpnKeywords](policy-csp-deliveryoptimization.md#dovpnkeywords)
+## DeviceGuard
+
+- [MachineIdentityIsolation](policy-csp-deviceguard.md#machineidentityisolation)
+
## DevicePreparation CSP
- [PageEnabled](devicepreparation-csp.md#pageenabled)
@@ -80,6 +85,12 @@ This article lists the policies that are applicable for Windows Insider Preview
- [AttestErrorMessage](healthattestation-csp.md#attesterrormessage)
+## HumanPresence
+
+- [ForcePrivacyScreen](policy-csp-humanpresence.md#forceprivacyscreen)
+- [ForcePrivacyScreenDim](policy-csp-humanpresence.md#forceprivacyscreendim)
+- [ForcePrivacyScreenNotification](policy-csp-humanpresence.md#forceprivacyscreennotification)
+
## InternetExplorer
- [AllowLegacyURLFields](policy-csp-internetexplorer.md#allowlegacyurlfields)
@@ -115,6 +126,10 @@ This article lists the policies that are applicable for Windows Insider Preview
- [DisablePostLogonProvisioning](passportforwork-csp.md#devicetenantidpoliciesdisablepostlogonprovisioning)
+## Printers
+
+- [ConfigureIppTlsCertificatePolicy](policy-csp-printers.md#configureipptlscertificatepolicy)
+
## Reboot CSP
- [WeeklyRecurrent](reboot-csp.md#scheduleweeklyrecurrent)
diff --git a/windows/client-management/mdm/policy-csp-connectivity.md b/windows/client-management/mdm/policy-csp-connectivity.md
index 5ed3127e3f..a58ea71af2 100644
--- a/windows/client-management/mdm/policy-csp-connectivity.md
+++ b/windows/client-management/mdm/policy-csp-connectivity.md
@@ -1,7 +1,7 @@
---
title: Connectivity Policy CSP
description: Learn more about the Connectivity Area in Policy CSP.
-ms.date: 11/05/2024
+ms.date: 01/14/2025
---
@@ -684,6 +684,61 @@ This policy makes all configurable settings in the 'Cellular' Settings page read
+
+## DisableCrossDeviceResume
+
+
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| ❌ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
+
+
+
+```User
+./User/Vendor/MSFT/Policy/Config/Connectivity/DisableCrossDeviceResume
+```
+
+
+
+
+This policy allows IT admins to turn off CrossDeviceResume feature to continue tasks, such as browsing file, continue using 1P/3P apps that require linking between Phone and PC.
+
+- If you enable this policy setting, the Windows device won't receive any CrossDeviceResume notification.
+
+- If you disable this policy setting, the Windows device will receive notification to resume activity from linked phone.
+
+- If you don't configure this policy setting, the default behavior is that the CrossDeviceResume feature is turned 'ON'. Changes to this policy take effect on reboot.
+
+
+
+
+
+
+
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | `int` |
+| Access Type | Add, Delete, Get, Replace |
+| Default Value | 0 |
+
+
+
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| 0 (Default) | CrossDeviceResume is Enabled. |
+| 1 | CrossDeviceResume is Disabled. |
+
+
+
+
+
+
+
+
## DisableDownloadingOfPrintDriversOverHTTP
diff --git a/windows/client-management/mdm/policy-csp-deliveryoptimization.md b/windows/client-management/mdm/policy-csp-deliveryoptimization.md
index c058b8bccf..c8994390c1 100644
--- a/windows/client-management/mdm/policy-csp-deliveryoptimization.md
+++ b/windows/client-management/mdm/policy-csp-deliveryoptimization.md
@@ -1,7 +1,7 @@
---
title: DeliveryOptimization Policy CSP
description: Learn more about the DeliveryOptimization Area in Policy CSP.
-ms.date: 08/06/2024
+ms.date: 01/14/2025
---
@@ -93,7 +93,7 @@ The value 0 (zero) means "unlimited" cache; Delivery Optimization will clear the
-Specifies whether the device is allowed to participate in Peer Caching while connected via VPN to the domain network. This means the device can download from or upload to other domain network devices, either on VPN or on the corporate domain network.
+Specifies whether the device, with an active VPN connection, is allowed to participate in P2P or not.
@@ -240,10 +240,18 @@ If this policy isn't configured, the client will attempt to automatically find a
|:--|:--|
| Format | `int` |
| Access Type | Add, Delete, Get, Replace |
-| Allowed Values | Range: `[0-4294967295]` |
| Default Value | 0 |
+
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| 1 | DHCP Option 235. |
+| 2 | DHCP Option 235 Force. |
+
+
**Group policy mapping**:
@@ -342,7 +350,7 @@ The recommended value is 1 hour (3600).
-Specifies the time in seconds to delay the fallback from Cache Server to the HTTP source for a background content download. Note that the DODelayBackgroundDownloadFromHttp policy takes precedence over this policy to allow downloads from peers first.
+For background downloads that use a cache server, specifies the time to wait before falling back to download from the original HTTP source.
@@ -397,7 +405,7 @@ Specifies the time in seconds to delay the fallback from Cache Server to the HTT
-Specifies the time in seconds to delay the fallback from Cache Server to the HTTP source for foreground content download. Note that the DODelayForegroundDownloadFromHttp policy takes precedence over this policy to allow downloads from peers first.
+For foreground downloads that use a cache server, specifies the time to wait before falling back to download from the original HTTP source.
@@ -513,7 +521,7 @@ The recommended value is 1 minute (60).
-Disallow downloads from Microsoft Connected Cache servers when the device connects via VPN. By default, the device is allowed to download from Microsoft Connected Cache when connected via VPN.
+Specify to disallow downloads from Microsoft Connected Cache servers when the device has an active VPN connection. By default, the button is 'Not Set'. This means the device is allowed to download from Microsoft Connected Cache when the device has an active VPN connection. To block these downloads, turn the button on to 'Enabled'.
@@ -535,8 +543,8 @@ Disallow downloads from Microsoft Connected Cache servers when the device connec
| Value | Description |
|:--|:--|
-| 0 (Default) | Allowed. |
-| 1 | Not allowed. |
+| 0 (Default) | Not Set. |
+| 1 | Enabled. |
@@ -572,7 +580,7 @@ Disallow downloads from Microsoft Connected Cache servers when the device connec
-Specifies the download method that Delivery Optimization can use in downloads of Windows Updates, Apps and App updates. The default value is 1.
+Specifies the method that Delivery Optimization can use to download content on behalf of various Microsoft products.
@@ -598,10 +606,10 @@ Specifies the download method that Delivery Optimization can use in downloads of
|:--|:--|
| 0 (Default) | HTTP only, no peering. |
| 1 | HTTP blended with peering behind the same NAT. |
-| 2 | When this option is selected, peering will cross NATs. To create a custom group use Group ID in combination with Mode 2. |
+| 2 | HTTP blended with peering across a private group. |
| 3 | HTTP blended with Internet peering. |
-| 99 | Simple download mode with no peering. Delivery Optimization downloads using HTTP only and doesn't attempt to contact the Delivery Optimization cloud services. Added in Windows 10, version 1607. |
-| 100 | Bypass mode. Windows 10: Don't use Delivery Optimization and use BITS instead. Windows 11: Deprecated, use Simple mode instead. |
+| 99 | HTTP only, no peering, no use of DO cloud service. |
+| 100 | Bypass mode, deprecated in Windows 11. |
@@ -698,7 +706,7 @@ Note this is a best effort optimization and shouldn't be relied on for an authen
-Set this policy to restrict peer selection to a specific source. Available options are: 1 = AD Site, 2 = Authenticated domain SID, 3 = DHCP Option ID, 4 = DNS Suffix, 5 = Microsoft Entra ID. When set, the Group ID will be assigned automatically from the selected source. This policy is ignored if the GroupID policy is also set. The options set in this policy only apply to Group (2) download mode. If Group (2) isn't set as Download mode, this policy will be ignored. For option 3 - DHCP Option ID, the client will query DHCP Option ID 234 and use the returned GUID value as the Group ID. Starting with Windows 10, version 1903, you can use the Microsoft Entra tenant ID as a means to define groups. To do this, set the value of DOGroupIdSource to 5.
+Specifies the source of group ID used for peer selection.
@@ -722,12 +730,12 @@ Set this policy to restrict peer selection to a specific source. Available optio
| Value | Description |
|:--|:--|
-| 0 (Default) | Unset. |
+| 0 (Default) | Not Set. |
| 1 | AD site. |
| 2 | Authenticated domain SID. |
-| 3 | DHCP user option. |
-| 4 | DNS suffix. |
-| 5 | Microsoft Entra ID. |
+| 3 | DHCP Option ID. |
+| 4 | DNS Suffix. |
+| 5 | Entra ID Tenant ID. |
@@ -824,7 +832,7 @@ The default value 0 (zero) means that Delivery Optimization dynamically adjusts
-Specifies the maximum time in seconds that each file is held in the Delivery Optimization cache after downloading successfully. The value 0 (zero) means unlimited; Delivery Optimization will hold the files in the cache longer and make the files available for uploads to other devices, as long as the cache size hasn't exceeded. The value 0 is new in Windows 10, version 1607. The default value is 604800 seconds (7 days).
+Specifies the maximum time in seconds that each file is held in the Delivery Optimization cache after downloading successfully.
@@ -879,7 +887,7 @@ Specifies the maximum time in seconds that each file is held in the Delivery Opt
-Specifies the maximum cache size that Delivery Optimization can utilize, as a percentage of disk size (1-100). The default value is 20.
+Specifies the maximum cache size that Delivery Optimization can utilize, as a percentage of the available drive space.
@@ -991,7 +999,7 @@ The default value 0 (zero) means that Delivery Optimization dynamically adjusts
-Specifies the minimum download QoS (Quality of Service or speed) in KiloBytes/sec for background downloads. This policy affects the blending of peer and HTTP sources. Delivery Optimization complements the download from the HTTP source to achieve the minimum QoS value set. The default value is 20480 (20 MB/s).
+Specifies the minimum download QoS (Quality of Service) in KiloBytes/sec for background downloads.
@@ -1165,7 +1173,7 @@ Recommended values: 64 GB to 256 GB.
-Specifies the minimum content file size in MB enabled to use Peer Caching. Recommended values: 1 MB to 100,000 MB. The default value is 100 MB.
+Specifies the minimum content file size in MB eligible to use P2P.
@@ -1220,7 +1228,7 @@ Specifies the minimum content file size in MB enabled to use Peer Caching. Recom
-Specifies the minimum RAM size in GB required to use Peer Caching. For example, if the minimum set is 1 GB, then devices with 1 GB or higher available RAM will be allowed to use Peer caching. Recommended values: 1 GB to 4 GB. The default value is 4 GB.
+Specifies the minimum total RAM size in GB required to use P2P.
@@ -1330,7 +1338,7 @@ By default, %SystemDrive% is used to store the cache. The drive location can be
-Specifies the maximum total bytes in GB that Delivery Optimization is allowed to upload to Internet peers in each calendar month. The value 0 (zero) means unlimited; No monthly upload limit's applied if 0 is set. The default value is 5120 (5 TB).
+Specifies the maximum bytes in GB that Delivery Optimization is allowed to upload to Internet peers in each calendar month.
@@ -1501,7 +1509,7 @@ The default value 0 (zero) means that Delivery Optimization dynamically adjusts
-Set this policy to restrict peer selection via selected option. Options available are: 1=Subnet mask, 2 = Local discovery (DNS-SD). These options apply to both Download Mode LAN (1) and Group (2).
+Specifies to restrict peer selection using the selected method, in addition to the DownloadMode policy.
@@ -1528,7 +1536,7 @@ In Windows 11 the 'Local Peer Discovery' option was introduced to restrict peer
|:--|:--|
| 0 (Default) | None. |
| 1 | Subnet mask. |
-| 2 | Local peer discovery (DNS-SD). |
+| 2 | Local discovery (DNS-SD). |
diff --git a/windows/client-management/mdm/policy-csp-deviceguard.md b/windows/client-management/mdm/policy-csp-deviceguard.md
index c27a142696..ba7cfacf34 100644
--- a/windows/client-management/mdm/policy-csp-deviceguard.md
+++ b/windows/client-management/mdm/policy-csp-deviceguard.md
@@ -1,7 +1,7 @@
---
title: DeviceGuard Policy CSP
description: Learn more about the DeviceGuard Area in Policy CSP.
-ms.date: 01/18/2024
+ms.date: 01/14/2025
---
@@ -9,6 +9,8 @@ ms.date: 01/18/2024
# Policy CSP - DeviceGuard
+[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)]
+
@@ -205,6 +207,70 @@ Credential Guard Configuration: 0 - Turns off CredentialGuard remotely if config
+
+## MachineIdentityIsolation
+
+
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| ✅ Device
❌ User | ❌ Pro
✅ Enterprise
✅ Education
❌ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
+
+
+
+```Device
+./Device/Vendor/MSFT/Policy/Config/DeviceGuard/MachineIdentityIsolation
+```
+
+
+
+
+Machine Identity Isolation: 0 - Machine password is only LSASS-bound and stored in $MACHINE.ACC registry key. 1 - Machine password both LSASS-bound and IUM-bound. It's stored in $MACHINE.ACC and $MACHINE.ACC.IUM registry keys. 2 - Machine password is only IUM-bound and stored in $MACHINE.ACC.IUM registry key.
+
+
+
+
+
+
+
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | `int` |
+| Access Type | Add, Delete, Get, Replace |
+| Default Value | 0 |
+
+
+
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| 0 (Default) | (Disabled) Machine password is only LSASS-bound and stored in $MACHINE.ACC registry key. |
+| 1 | (Enabled in audit mode) Machine password both LSASS-bound and IUM-bound. It's stored in $MACHINE.ACC and $MACHINE.ACC.IUM registry keys. |
+| 2 | (Enabled in enforcement mode) Machine password is only IUM-bound and stored in $MACHINE.ACC.IUM registry key. |
+
+
+
+**Group policy mapping**:
+
+| Name | Value |
+|:--|:--|
+| Name | VirtualizationBasedSecurity |
+| Friendly Name | Turn On Virtualization Based Security |
+| Element Name | Machine Identity Isolation Configuration. |
+| Location | Computer Configuration |
+| Path | System > Device Guard |
+| Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\DeviceGuard |
+| ADMX File Name | DeviceGuard.admx |
+
+
+
+
+
+
+
+
## RequirePlatformSecurityFeatures
diff --git a/windows/client-management/mdm/policy-csp-humanpresence.md b/windows/client-management/mdm/policy-csp-humanpresence.md
index 1cf592ddff..b27018ae74 100644
--- a/windows/client-management/mdm/policy-csp-humanpresence.md
+++ b/windows/client-management/mdm/policy-csp-humanpresence.md
@@ -1,7 +1,7 @@
---
title: HumanPresence Policy CSP
description: Learn more about the HumanPresence Area in Policy CSP.
-ms.date: 09/27/2024
+ms.date: 01/14/2025
---
@@ -9,6 +9,8 @@ ms.date: 09/27/2024
# Policy CSP - HumanPresence
+[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)]
+
@@ -526,6 +528,183 @@ Determines the timeout for Lock on Leave forced by the MDM policy. The user will
+
+## ForcePrivacyScreen
+
+
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
❌ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
+
+
+
+```Device
+./Device/Vendor/MSFT/Policy/Config/HumanPresence/ForcePrivacyScreen
+```
+
+
+
+
+Determines whether detect when other people are looking at my screen is forced on/off by the MDM policy. The user won't be able to change this setting and the UI will be greyed out.
+
+
+
+
+
+
+
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | `int` |
+| Access Type | Add, Delete, Get, Replace |
+| Default Value | 0 |
+
+
+
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| 2 | ForcedOff. |
+| 1 | ForcedOn. |
+| 0 (Default) | DefaultToUserChoice. |
+
+
+
+**Group policy mapping**:
+
+| Name | Value |
+|:--|:--|
+| Name | ForcePrivacyScreen |
+| Path | Sensors > AT > WindowsComponents > HumanPresence |
+
+
+
+
+
+
+
+
+
+## ForcePrivacyScreenDim
+
+
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
❌ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
+
+
+
+```Device
+./Device/Vendor/MSFT/Policy/Config/HumanPresence/ForcePrivacyScreenDim
+```
+
+
+
+
+Determines whether dim the screen when other people are looking at my screen checkbox is forced checked/unchecked by the MDM policy. The user won't be able to change this setting and the checkbox in the UI will be greyed out.
+
+
+
+
+
+
+
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | `int` |
+| Access Type | Add, Delete, Get, Replace |
+| Default Value | 0 |
+
+
+
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| 2 | ForcedUnchecked. |
+| 1 | ForcedChecked. |
+| 0 (Default) | DefaultToUserChoice. |
+
+
+
+**Group policy mapping**:
+
+| Name | Value |
+|:--|:--|
+| Name | ForcePrivacyScreenDim |
+| Path | Sensors > AT > WindowsComponents > HumanPresence |
+
+
+
+
+
+
+
+
+
+## ForcePrivacyScreenNotification
+
+
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
❌ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
+
+
+
+```Device
+./Device/Vendor/MSFT/Policy/Config/HumanPresence/ForcePrivacyScreenNotification
+```
+
+
+
+
+Determines whether providing alert when people are looking at my screen checkbox is forced checked/unchecked by the MDM policy. The user won't be able to change this setting and the checkbox in the UI will be greyed out.
+
+
+
+
+
+
+
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | `int` |
+| Access Type | Add, Delete, Get, Replace |
+| Default Value | 0 |
+
+
+
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| 2 | ForcedUnchecked. |
+| 1 | ForcedChecked. |
+| 0 (Default) | DefaultToUserChoice. |
+
+
+
+**Group policy mapping**:
+
+| Name | Value |
+|:--|:--|
+| Name | ForcePrivacyScreenNotification |
+| Path | Sensors > AT > WindowsComponents > HumanPresence |
+
+
+
+
+
+
+
+
diff --git a/windows/client-management/mdm/policy-csp-printers.md b/windows/client-management/mdm/policy-csp-printers.md
index 098733446d..b852afb0b4 100644
--- a/windows/client-management/mdm/policy-csp-printers.md
+++ b/windows/client-management/mdm/policy-csp-printers.md
@@ -1,7 +1,7 @@
---
title: Printers Policy CSP
description: Learn more about the Printers Area in Policy CSP.
-ms.date: 09/27/2024
+ms.date: 01/14/2025
---
@@ -11,6 +11,8 @@ ms.date: 09/27/2024
[!INCLUDE [ADMX-backed CSP tip](includes/mdm-admx-csp-note.md)]
+[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)]
+
@@ -348,6 +350,56 @@ The following are the supported values:
+
+## ConfigureIppTlsCertificatePolicy
+
+
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
+
+
+
+```Device
+./Device/Vendor/MSFT/Policy/Config/Printers/ConfigureIppTlsCertificatePolicy
+```
+
+
+
+
+
+
+
+
+
+
+
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | `chr` (string) |
+| Access Type | Add, Delete, Get, Replace |
+
+
+
+
+[!INCLUDE [ADMX-backed policy note](includes/mdm-admx-policy-note.md)]
+
+**ADMX mapping**:
+
+| Name | Value |
+|:--|:--|
+| Name | ConfigureIppTlsCertificatePolicy |
+| ADMX File Name | Printing.admx |
+
+
+
+
+
+
+
+
## ConfigureRedirectionGuardPolicy
diff --git a/windows/client-management/mdm/vpnv2-csp.md b/windows/client-management/mdm/vpnv2-csp.md
index 58d6463c97..f8ca2e1a8a 100644
--- a/windows/client-management/mdm/vpnv2-csp.md
+++ b/windows/client-management/mdm/vpnv2-csp.md
@@ -1,7 +1,7 @@
---
title: VPNv2 CSP
description: Learn more about the VPNv2 CSP.
-ms.date: 01/18/2024
+ms.date: 01/14/2025
---
@@ -863,11 +863,7 @@ Returns the type of App/Id. This value can be either of the following: PackageFa
-False: Don't Bypass for Local traffic.
-
-True: ByPass VPN Interface for Local Traffic.
-
-Optional. When this setting is True, requests to local resources that are available on the same Wi-Fi network as the VPN client can bypass the VPN. For example, if enterprise policy for VPN requires force tunnel for VPN, but enterprise intends to allow the remote user to connect locally to media center in their home, then this option should be set to True. The user can bypass VPN for local subnet traffic. When this is set to False, the setting is disabled and no subnet exceptions are allowed.
+Not supported.
@@ -5160,11 +5156,7 @@ Returns the type of App/Id. This value can be either of the following: PackageFa
-False: Don't Bypass for Local traffic.
-
-True: ByPass VPN Interface for Local Traffic.
-
-Optional. When this setting is True, requests to local resources that are available on the same Wi-Fi network as the VPN client can bypass the VPN. For example, if enterprise policy for VPN requires force tunnel for VPN, but enterprise intends to allow the remote user to connect locally to media center in their home, then this option should be set to True. The user can bypass VPN for local subnet traffic. When this is set to False, the setting is disabled and no subnet exceptions are allowed.
+Not supported.
diff --git a/windows/client-management/mdm/vpnv2-ddf-file.md b/windows/client-management/mdm/vpnv2-ddf-file.md
index abe39e405a..8927c4cc29 100644
--- a/windows/client-management/mdm/vpnv2-ddf-file.md
+++ b/windows/client-management/mdm/vpnv2-ddf-file.md
@@ -1,7 +1,7 @@
---
title: VPNv2 DDF file
description: View the XML file containing the device description framework (DDF) for the VPNv2 configuration service provider.
-ms.date: 06/28/2024
+ms.date: 01/14/2025
---
@@ -1156,10 +1156,7 @@ The following XML file contains the device description framework (DDF) for the V
- False : Do not Bypass for Local traffic
- True : ByPass VPN Interface for Local Traffic
-
- Optional. When this setting is True, requests to local resources that are available on the same Wi-Fi network as the VPN client can bypass the VPN. For example, if enterprise policy for VPN requires force tunnel for VPN, but enterprise intends to allow the remote user to connect locally to media center in their home, then this option should be set to True. The user can bypass VPN for local subnet traffic. When this is set to False, the setting is disabled and no subnet exceptions are allowed.
+ Not supported.
@@ -4425,10 +4422,7 @@ A device tunnel profile must be deleted before another device tunnel profile can
- False : Do not Bypass for Local traffic
- True : ByPass VPN Interface for Local Traffic
-
- Optional. When this setting is True, requests to local resources that are available on the same Wi-Fi network as the VPN client can bypass the VPN. For example, if enterprise policy for VPN requires force tunnel for VPN, but enterprise intends to allow the remote user to connect locally to media center in their home, then this option should be set to True. The user can bypass VPN for local subnet traffic. When this is set to False, the setting is disabled and no subnet exceptions are allowed.
+ Not supported.
From 6937671796a00c3999e5395b45d37f5c153f89b7 Mon Sep 17 00:00:00 2001
From: "Vinay Pamnani (from Dev Box)"
Date: Tue, 21 Jan 2025 14:25:02 -0700
Subject: [PATCH 02/86] Updates
---
.../mdm/policy-csp-deliveryoptimization.md | 92 +++++--------------
1 file changed, 22 insertions(+), 70 deletions(-)
diff --git a/windows/client-management/mdm/policy-csp-deliveryoptimization.md b/windows/client-management/mdm/policy-csp-deliveryoptimization.md
index c8994390c1..6fd24a5ef3 100644
--- a/windows/client-management/mdm/policy-csp-deliveryoptimization.md
+++ b/windows/client-management/mdm/policy-csp-deliveryoptimization.md
@@ -1,7 +1,7 @@
---
title: DeliveryOptimization Policy CSP
description: Learn more about the DeliveryOptimization Area in Policy CSP.
-ms.date: 01/14/2025
+ms.date: 01/21/2025
---
@@ -34,11 +34,7 @@ ms.date: 01/14/2025
-Specifies the maximum size in GB of Delivery Optimization cache.
-
-This policy overrides the DOMaxCacheSize policy.
-
-The value 0 (zero) means "unlimited" cache; Delivery Optimization will clear the cache when the device runs low on disk space.
+Specifies the maximum size in GB of Delivery Optimization cache. This policy overrides the MaxCacheSize policy.
@@ -125,8 +121,8 @@ Specifies whether the device, with an active VPN connection, is allowed to parti
| Name | Value |
|:--|:--|
| Name | AllowVPNPeerCaching |
-| Friendly Name | Enable Peer Caching while the device connects via VPN |
-| Element Name | Enable Peer Caching while the device connects via VPN. |
+| Friendly Name | Enable P2P while the device connects via VPN |
+| Element Name | Enable P2P while the device connects via VPN. |
| Location | Computer Configuration |
| Path | Windows Components > Delivery Optimization |
| Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization |
@@ -156,9 +152,7 @@ Specifies whether the device, with an active VPN connection, is allowed to parti
-This policy allows you to set one or more Microsoft Connected Cache servers that will be used by your client(s).
-
-One or more values can be added as either fully qualified domain names (FQDN) or IP addresses. To add multiple values, separate each FQDN or IP address by commas.
+Specifies one or more Microsoft Connected Cache servers that will be used by your client(s). One or more values can be added as either fully qualified domain names (FQDN) or IP addresses. To add multiple values, separate each FQDN or IP address by commas.
@@ -214,17 +208,10 @@ One or more values can be added as either fully qualified domain names (FQDN) or
-This policy allows you to specify how your client(s) can discover Microsoft Connected Cache servers dynamically.
-
-Options available are:
-
-0 = Disable DNS-SD.
-
-1 = DHCP Option 235.
+Specifies how your client(s) can discover Microsoft Connected Cache servers dynamically.
+1 = DHCP Option 235
2 = DHCP Option 235 Force.
-
-If this policy isn't configured, the client will attempt to automatically find a cache server using DNS-SD. If set to 0, the client won't use DNS-SD to automatically find a cache server. If set to 1 or 2, the client will query DHCP Option ID 235 and use the returned value as the Cache Server Hostname. Option 2 overrides the Cache Server Hostname policy, if configured.
@@ -289,13 +276,7 @@ If this policy isn't configured, the client will attempt to automatically find a
-This policy allows you to delay the use of an HTTP source in a background download that's allowed to use P2P.
-
-After the max delay has reached, the download will resume using HTTP, either downloading the entire payload or complementing the bytes that couldn't be downloaded from Peers.
-
-Note that a download that's waiting for peer sources, will appear to be stuck for the end user.
-
-The recommended value is 1 hour (3600).
+For background downloads that use P2P, specifies the time to wait before starting to download from the HTTP source.
@@ -319,7 +300,7 @@ The recommended value is 1 hour (3600).
| Name | Value |
|:--|:--|
| Name | DelayBackgroundDownloadFromHttp |
-| Friendly Name | Delay background download from http (in secs) |
+| Friendly Name | Delay background download from http (in seconds) |
| Element Name | Delay background download from http (in secs) |
| Location | Computer Configuration |
| Path | Windows Components > Delivery Optimization |
@@ -460,13 +441,7 @@ For foreground downloads that use a cache server, specifies the time to wait bef
-This policy allows you to delay the use of an HTTP source in a foreground (interactive) download that's allowed to use P2P.
-
-After the max delay has reached, the download will resume using HTTP, either downloading the entire payload or complementing the bytes that couldn't be downloaded from Peers.
-
-Note that a download that's waiting for peer sources, will appear to be stuck for the end user.
-
-The recommended value is 1 minute (60).
+For foreground downloads that use P2P, specifies the time to wait before starting to download from the HTTP source.
@@ -490,7 +465,7 @@ The recommended value is 1 minute (60).
| Name | Value |
|:--|:--|
| Name | DelayForegroundDownloadFromHttp |
-| Friendly Name | Delay Foreground download from http (in secs) |
+| Friendly Name | Delay Foreground download from http (in seconds) |
| Element Name | Delay Foreground download from http (in secs) |
| Location | Computer Configuration |
| Path | Windows Components > Delivery Optimization |
@@ -649,11 +624,7 @@ Specifies the method that Delivery Optimization can use to download content on b
-Group ID must be set as a GUID. This Policy specifies an arbitrary group ID that the device belongs to.
-
-Use this if you need to create a single group for Local Network Peering for branches that are on different domains or aren't on the same LAN.
-
-Note this is a best effort optimization and shouldn't be relied on for an authentication of identity.
+Specifies an arbitrary group ID that the device belongs to. A GUID must be used.
@@ -776,8 +747,6 @@ Specifies the source of group ID used for peer selection.
Specifies the maximum background download bandwidth in KiloBytes/second that the device can use across all concurrent download activities using Delivery Optimization.
-
-The default value 0 (zero) means that Delivery Optimization dynamically adjusts to use the available bandwidth for downloads.
@@ -943,8 +912,6 @@ Specifies the maximum cache size that Delivery Optimization can utilize, as a pe
Specifies the maximum foreground download bandwidth in KiloBytes/second that the device can use across all concurrent download activities using Delivery Optimization.
-
-The default value 0 (zero) means that Delivery Optimization dynamically adjusts to use the available bandwidth for downloads.
@@ -1054,11 +1021,7 @@ Specifies the minimum download QoS (Quality of Service) in KiloBytes/sec for bac
-Specify any value between 1 and 100 (in percentage) to allow the device to upload data to LAN and Group peers while on DC power (Battery).
-
-The recommended value to set if you allow uploads on battery is 40 (for 40%). The device can download from peers while on battery regardless of this policy.
-
-The value 0 means "not-limited"; The cloud service set default value will be used.
+Specifies the minimum battery level required for uploading to peers, while on battery power.
@@ -1113,12 +1076,7 @@ The value 0 means "not-limited"; The cloud service set default value will be use
-Specifies the required minimum disk size (capacity in GB) for the device to use Peer Caching. The cloud service set default value will be used.
-
-Recommended values: 64 GB to 256 GB.
-
-> [!NOTE]
-> If the DOModifyCacheDrive policy is set, the disk size check will apply to the new working directory specified by this policy.
+Specifies the required minimum total disk size in GB for the device to use P2P.
@@ -1142,8 +1100,8 @@ Recommended values: 64 GB to 256 GB.
| Name | Value |
|:--|:--|
| Name | MinDiskSizeAllowedToPeer |
-| Friendly Name | Minimum disk size allowed to use Peer Caching (in GB) |
-| Element Name | Minimum disk size allowed to use Peer Caching (in GB) |
+| Friendly Name | Minimum disk size allowed to use P2P (in GB) |
+| Element Name | Minimum disk size allowed to use P2P (in GB) |
| Location | Computer Configuration |
| Path | Windows Components > Delivery Optimization |
| Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization |
@@ -1197,8 +1155,8 @@ Specifies the minimum content file size in MB eligible to use P2P.
| Name | Value |
|:--|:--|
| Name | MinFileSizeToCache |
-| Friendly Name | Minimum Peer Caching Content File Size (in MB) |
-| Element Name | Minimum Peer Caching Content File Size (in MB) |
+| Friendly Name | Minimum P2P Content File Size (in MB) |
+| Element Name | Minimum P2P Content File Size (in MB) |
| Location | Computer Configuration |
| Path | Windows Components > Delivery Optimization |
| Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization |
@@ -1252,8 +1210,8 @@ Specifies the minimum total RAM size in GB required to use P2P.
| Name | Value |
|:--|:--|
| Name | MinRAMAllowedToPeer |
-| Friendly Name | Minimum RAM capacity (inclusive) required to enable use of Peer Caching (in GB) |
-| Element Name | Minimum RAM capacity (inclusive) required to enable use of Peer Caching (in GB) |
+| Friendly Name | Minimum RAM capacity (inclusive) required to enable use of P2P (in GB) |
+| Element Name | Minimum RAM capacity (inclusive) required to enable use of P2P (in GB) |
| Location | Computer Configuration |
| Path | Windows Components > Delivery Optimization |
| Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization |
@@ -1283,9 +1241,7 @@ Specifies the minimum total RAM size in GB required to use P2P.
-Specifies the drive Delivery Optimization shall use for its cache.
-
-By default, %SystemDrive% is used to store the cache. The drive location can be specified using environment variables, drive letter or using a full path.
+Specifies the drive that Delivery Optimization should use for its cache. The drive location can be specified using environment variables, drive letter or using a full path.
@@ -1394,8 +1350,6 @@ Specifies the maximum bytes in GB that Delivery Optimization is allowed to uploa
Specifies the maximum background download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth.
-
-The default value 0 (zero) means that Delivery Optimization dynamically adjusts to use the available bandwidth for background downloads.
@@ -1453,8 +1407,6 @@ Downloads from LAN peers won't be throttled even when this policy is set.
Specifies the maximum foreground download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth.
-
-The default value 0 (zero) means that Delivery Optimization dynamically adjusts to use the available bandwidth for foreground downloads.
@@ -1689,7 +1641,7 @@ This policy allows an IT Admin to define the following details:
-This policy allows you to set one or more keywords used to recognize VPN connections. To add multiple keywords, separate them with commas.
+Specifies one or more keywords used to recognize VPN connections. To add multiple keywords, separate each by a comma.
From 682bf3f67fb7995ed8be63b899adff8b332c12c3 Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Wed, 22 Jan 2025 15:51:43 -0800
Subject: [PATCH 03/86] ccu-9693727
---
.../catalog-checkpoint-cumulative-updates.md | 66 +++++++++++++++++++
1 file changed, 66 insertions(+)
create mode 100644 windows/deployment/update/catalog-checkpoint-cumulative-updates.md
diff --git a/windows/deployment/update/catalog-checkpoint-cumulative-updates.md b/windows/deployment/update/catalog-checkpoint-cumulative-updates.md
new file mode 100644
index 0000000000..66e7894d4f
--- /dev/null
+++ b/windows/deployment/update/catalog-checkpoint-cumulative-updates.md
@@ -0,0 +1,66 @@
+---
+title: Checkpoint cumulative updates and the Microsoft Update Catalog
+description: This article describes how to handle checkpoint cumulative updates when you use the Microsoft Update Catalog to update devices and images.
+ms.service: windows-client
+ms.subservice: itpro-updates
+ms.topic: conceptual
+ms.author: mstewart
+author: mestew
+manager: aaroncz
+ms.collection:
+ - tier2
+ms.localizationpriority: medium
+appliesto:
+ - ✅ Windows 11, version 24H2 and later
+ms.date: 01/23/2025
+---
+
+# Checkpoint cumulative updates and Microsoft Update Catalog usage
+
+Starting Windows 11, version 24H2, monthly security updates and optional nonsecurity preview release updates may be preceded by a checkpoint cumulative update (CU). Devices (and images) updating from Windows Update (WU) and Windows Server Update Services (WSUS) release channels can continue to seamlessly install the latest monthly security update or the optional nonsecurity preview release regardless of whether there are any preceding checkpoint CUs, so update processes involving WU and WSUS remain unchanged. This article covers how Catalog users can easily update their devices (or images) through checkpoint CUs.
+
+## Checkpoint CUs
+
+Windows 11 quality updates use servicing technology and are built cumulatively from the time when a new Windows OS was "released to manufacturing" (RTM). These monthly updates include all the changes since RTM in the form of binary differentials computed from the initial version of those binaries.
+
+With Windows 11, version 24H2, Microsoft introduced a new concept of checkpoint cumulative updates. This will allow you to get features and security enhancements via the latest cumulative update through smaller, incremental differentials containing only the changes since the previous checkpoint cumulative update. This means that you can save time, bandwidth, and hard drive space.
+
+Going forward, Microsoft might periodically release cumulative updates as checkpoints. The subsequent updates will then consist of:
+- The update package files associated with the checkpoints, and
+- New update package files that contain incremental binary differentials against the version of binaries in the last checkpoint.
+
+This process may be repeated multiple times, thereby generating multiple checkpoints during the lifecycle of a given Windows release. The Windows 11, version 24H2 servicing stack can merge all the checkpoints and only download and install content that's missing on the device.
+
+If any checkpoint CUs precede a target update, a device or image needs to take all prior checkpoint CUs before it can take the target update. In other words, a post-checkpoint LCU can be applied to images/devices that are on that checkpoint or on a subsequent LCU. For updates sourced from WU and WSUS this happens seamlessly, and you can continue to use the same tools and processes that you currently use for approving and deploying updates.
+
+### Applicability
+
+A checkpoint CU is just another monthly security update that informs how subsequent updates are built. There is no policy change or new requirement around when users must take these updates, though it is best practice to take monthly security updates at the earliest opportunity to keep your devices protected and productive.
+
+This feature does not introduce any change to the applicability of monthly security updates. As before, these updates apply to the main OS (install.wim) and to WinPE (boot.wim) but not to WinRE (winre.wim).
+
+WinRE is serviced by applying the servicing stack update (SSU) from OnePackage (LCU does not apply) and SafeOS DU. This is how it has been for a while now, and there is no recent change to WinRE servicing and certainly no change due to the checkpoint cumulative updates feature. We understand that not everybody may have had a shared understanding about this, but applying SSU then SafeOS DU is the only way to ensure WinRE is serviced. For more information, see [Update Windows installation media with Dynamic Update](media-dynamic-update.md).
+
+### Current Checkpoint CUs
+
+For Windows 11, version 24H2 and above, for a given update the KB article will note all preceding checkpoint CUs under the **Catalog** release channel tab. We expect that your experience updating through a checkpoint CU will position you to efficiently take future checkpoint CUs.
+
+## Updating from the Microsoft Update Catalog
+
+When installing a given monthly security or optional nonsecurity preview update, [Microsoft Update Catalog](https://www.catalog.update.microsoft.com) users can determine and download the prior checkpoint CUs and apply these sequentially under certain situations or in one go using DISM.
+
+### Finding prior Checkpoint CUs
+
+For a given update, users can look up the KB article and find all preceding checkpoints, if any, listed under the **Catalog** release channel. For instance, the 2024-12 monthly security update (KB5048667) has one preceding checkpoint CU per [December 10, 2024—KB5048667 (OS Build 26100.2605)](https://support.microsoft.com/topic/708755a6-d809-4a8a-8d20-53c4108590e6#ID0ELBD=Catalog):
+
+
+
+**Method 2: Install each MSU file individually, in order**
+
+Download and install each MSU file individually either using DISM or [Windows Update Standalone Installer](https://support.microsoft.com/topic/799ba3df-ec7e-b05e-ee13-1cdae8f23b19) in the following order:
+
+- windows11.0-kb5043080-x64_953449672073f8fb99badb4cc6d5d7849b9c83e8.msu
+- windows11.0-kb5048667-x64_d4ad0ca69de9a02bc356757581e0e0d6960c9f93.msu
+
+
+
From f2bfea529bb9735e71bebb35ce5b87005da5aff0 Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Wed, 22 Jan 2025 15:56:20 -0800
Subject: [PATCH 04/86] ccu-9693727
---
.../catalog-checkpoint-cumulative-updates.md | 14 ++++++--------
1 file changed, 6 insertions(+), 8 deletions(-)
diff --git a/windows/deployment/update/catalog-checkpoint-cumulative-updates.md b/windows/deployment/update/catalog-checkpoint-cumulative-updates.md
index 66e7894d4f..c71bab2808 100644
--- a/windows/deployment/update/catalog-checkpoint-cumulative-updates.md
+++ b/windows/deployment/update/catalog-checkpoint-cumulative-updates.md
@@ -55,12 +55,10 @@ For a given update, users can look up the KB article and find all preceding chec
-**Method 2: Install each MSU file individually, in order**
-
-Download and install each MSU file individually either using DISM or [Windows Update Standalone Installer](https://support.microsoft.com/topic/799ba3df-ec7e-b05e-ee13-1cdae8f23b19) in the following order:
-
-- windows11.0-kb5043080-x64_953449672073f8fb99badb4cc6d5d7849b9c83e8.msu
-- windows11.0-kb5048667-x64_d4ad0ca69de9a02bc356757581e0e0d6960c9f93.msu
-
-
+Method 2: Install each MSU file individually, in order
+
+Download and install each MSU file individually either using DISM or [Windows Update Standalone Installer](https://support.microsoft.com/topic/799ba3df-ec7e-b05e-ee13-1cdae8f23b19) in the following order:
+
+
- windows11.0-kb5043080-x64_953449672073f8fb99badb4cc6d5d7849b9c83e8.msu
+- windows11.0-kb5048667-x64_d4ad0ca69de9a02bc356757581e0e0d6960c9f93.msu
From 1b7a8b67ffbf62f74038639b982cc760045a06c7 Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Wed, 22 Jan 2025 16:08:51 -0800
Subject: [PATCH 05/86] ccu-9693727
---
.../update/catalog-checkpoint-cumulative-updates.md | 11 ++++-------
1 file changed, 4 insertions(+), 7 deletions(-)
diff --git a/windows/deployment/update/catalog-checkpoint-cumulative-updates.md b/windows/deployment/update/catalog-checkpoint-cumulative-updates.md
index c71bab2808..dc46168501 100644
--- a/windows/deployment/update/catalog-checkpoint-cumulative-updates.md
+++ b/windows/deployment/update/catalog-checkpoint-cumulative-updates.md
@@ -54,11 +54,8 @@ When installing a given monthly security or optional nonsecurity preview update,
For a given update, users can look up the KB article and find all preceding checkpoints, if any, listed under the **Catalog** release channel. For instance, the 2024-12 monthly security update (KB5048667) has one preceding checkpoint CU per [December 10, 2024—KB5048667 (OS Build 26100.2605)](https://support.microsoft.com/topic/708755a6-d809-4a8a-8d20-53c4108590e6#ID0ELBD=Catalog):
-
-Method 2: Install each MSU file individually, in order
-
-Download and install each MSU file individually either using DISM or [Windows Update Standalone Installer](https://support.microsoft.com/topic/799ba3df-ec7e-b05e-ee13-1cdae8f23b19) in the following order:
-
-
- windows11.0-kb5043080-x64_953449672073f8fb99badb4cc6d5d7849b9c83e8.msu
-- windows11.0-kb5048667-x64_d4ad0ca69de9a02bc356757581e0e0d6960c9f93.msu
+| |
+|---|
+|Method 2: Install each MSU file individually, in order Download and install each MSU file individually either using DISM or [Windows Update Standalone Installer](https://support.microsoft.com/topic/799ba3df-ec7e-b05e-ee13-1cdae8f23b19) in the following order:
- windows11.0-kb5043080-x64_953449672073f8fb99badb4cc6d5d7849b9c83e8.msu
- windows11.0-kb5048667-x64_d4ad0ca69de9a02bc356757581e0e0d6960c9f93.msu
|
+> Method 2: Install each MSU file individually, in order Download and install each MSU file individually either using DISM or [Windows Update Standalone Installer](https://support.microsoft.com/topic/799ba3df-ec7e-b05e-ee13-1cdae8f23b19) in the following order:
- windows11.0-kb5043080-x64_953449672073f8fb99badb4cc6d5d7849b9c83e8.msu
- windows11.0-kb5048667-x64_d4ad0ca69de9a02bc356757581e0e0d6960c9f93.msu
\ No newline at end of file
From ca009c6fd50474152576d128bfad6a55dfd7b928 Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Thu, 23 Jan 2025 11:12:49 -0800
Subject: [PATCH 06/86] ccu-9693727
---
.../catalog-checkpoint-cumulative-updates.md | 44 ++++++++++++++++---
1 file changed, 38 insertions(+), 6 deletions(-)
diff --git a/windows/deployment/update/catalog-checkpoint-cumulative-updates.md b/windows/deployment/update/catalog-checkpoint-cumulative-updates.md
index dc46168501..b6e802f722 100644
--- a/windows/deployment/update/catalog-checkpoint-cumulative-updates.md
+++ b/windows/deployment/update/catalog-checkpoint-cumulative-updates.md
@@ -43,7 +43,7 @@ WinRE is serviced by applying the servicing stack update (SSU) from OnePackage (
### Current Checkpoint CUs
-For Windows 11, version 24H2 and above, for a given update the KB article will note all preceding checkpoint CUs under the **Catalog** release channel tab. We expect that your experience updating through a checkpoint CU will position you to efficiently take future checkpoint CUs.
+For Windows 11, version 24H2 and above, for a given update the knowledge base (KB) article will note all preceding checkpoint CUs under the **Catalog** release channel tab. We expect that your experience updating through a checkpoint CU will position you to efficiently take future checkpoint CUs.
## Updating from the Microsoft Update Catalog
@@ -51,11 +51,43 @@ When installing a given monthly security or optional nonsecurity preview update,
### Finding prior Checkpoint CUs
-For a given update, users can look up the KB article and find all preceding checkpoints, if any, listed under the **Catalog** release channel. For instance, the 2024-12 monthly security update (KB5048667) has one preceding checkpoint CU per [December 10, 2024—KB5048667 (OS Build 26100.2605)](https://support.microsoft.com/topic/708755a6-d809-4a8a-8d20-53c4108590e6#ID0ELBD=Catalog):
+For a given update, users can look up the KB article and find all preceding checkpoints, if any, listed under the **Catalog** release channel. For instance, the 2024-12 monthly security update (KB5048667) has one preceding checkpoint CU per [December 10, 2024-KB5048667 (OS Build 26100.2605)](https://support.microsoft.com/topic/708755a6-d809-4a8a-8d20-53c4108590e6#ID0ELBD=Catalog):
+ > Method 2: Install each MSU file individually, in order Download and install each MSU file individually either using DISM or [Windows Update Standalone Installer](https://support.microsoft.com/topic/799ba3df-ec7e-b05e-ee13-1cdae8f23b19) in the following order:
- windows11.0-kb5043080-x64_953449672073f8fb99badb4cc6d5d7849b9c83e8.msu
- windows11.0-kb5048667-x64_d4ad0ca69de9a02bc356757581e0e0d6960c9f93.msu
-| |
-|---|
-|Method 2: Install each MSU file individually, in order Download and install each MSU file individually either using DISM or [Windows Update Standalone Installer](https://support.microsoft.com/topic/799ba3df-ec7e-b05e-ee13-1cdae8f23b19) in the following order:
- windows11.0-kb5043080-x64_953449672073f8fb99badb4cc6d5d7849b9c83e8.msu
- windows11.0-kb5048667-x64_d4ad0ca69de9a02bc356757581e0e0d6960c9f93.msu
|
+Alternately, users can search the KB number in the [Microsoft Update Catalog](https://catalog.update.microsoft.com/) and select the **Download** button for the selected architecture. The download pop-up shows all prior checkpoints for the update so that users can conveniently download all MSUs and apply them to their image or device. For instance, Microsoft Update Catalog shows the [2024-12 cumulative update (KB5048667)](https://support.microsoft.com/help/5048667) has one preceding checkpoint CU, [KB5043080](https://support.microsoft.com/help/5043080).
-> Method 2: Install each MSU file individually, in order Download and install each MSU file individually either using DISM or [Windows Update Standalone Installer](https://support.microsoft.com/topic/799ba3df-ec7e-b05e-ee13-1cdae8f23b19) in the following order:
- windows11.0-kb5043080-x64_953449672073f8fb99badb4cc6d5d7849b9c83e8.msu
- windows11.0-kb5048667-x64_d4ad0ca69de9a02bc356757581e0e0d6960c9f93.msu
\ No newline at end of file
+### Updating through Checkpoint CUs
+
+**Device has the latest checkpoint CU and doesn't need customization:**
+
+Devices or images that have the latest checkpoint CU installed and do not need Features on Demand (FoD) or language pack (LP) customization can be updated to the latest target CU with no change to your existing process. You can simply copy the target MSU from Catalog and install it, for instance using [Add-WindowsPackage (DISM)](/powershell/module/dism/add-windowspackage) or [DISM operating system package (`.cab` or `.msu`) servicing command-line options](/windows-hardware/manufacture/desktop/dism-operating-system-package-servicing-command-line-options).
+
+Examples of eligible devices:
+
+| Device is on | Needs to install|
+|---|---|
+|- The checkpoint CU, 2024-09 (KB5043080)
|- A subsequent monthly security update like 2024-11 (KB5046617), or
- A subsequent optional nonsecurity releaselike 2024-11 (KB5046740)
|
+|- A subsequent optional nonsecurity preview release like 2024-09 (KB5043178), or
- A subsequent monthly security update like 2024-10 (KB5044284)
|- A subsequent monthly security update like 2025-01 (KB5050009), or
- A subsequent optional nonsecurity release like 2024-11 (KB5046740)
|
+
+**Device needs FoD or LP customization:**
+
+Installing FoDs or LPs requires the full LCU payload, which now can be split across files associated with each preceding checkpoint CU. So, when customizing FoDs or LPs, all prior checkpoint CUs and the target CU need to be installed regardless of whether the device already had any of the prior checkpoints CU installed. This needs to be done using DISM.
+
+1. Copy the MSUs of the latest CU (the target) and all prior checkpoint CUs to a local folder. Make sure there are no other MSUs present.
+1. Mount the install.wim file.
+1. Run `DISM /add-package` with the latest MSU as the sole target.
+1. Run `/Cleanup-Image /StartComponentCleanup`.
+1. Unmount.
+1. Run `DISM /export-image` to optimize the image size, if that's important to you.
+
+**Device doesn't have the latest checkpoint CU and doesn't need customization:**
+
+Devices that are not on the latest checkpoint CU and do not need FoD/LP customization can either install all needed CUs one by one in the right sequence. Alternately they can be updated using DISM to install all CUs in one go, see above. If there are total 4 checkpoint CUs available and device already has the first one installed, DISM will apply the remaining 3 checkpoint CUs in the right order followed by the target CU, all in one go.
+
+## Related articles
+
+- [Servicing stack updates](/windows/deployment/update/servicing-stack-updates)
+- [Features on Demand](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities)
+- [How to download updates that include drivers and hotfixes from the Windows Update Catalog](/troubleshoot/windows-client/installing-updates-features-roles/download-updates-drivers-hotfixes-windows-update-catalog)
+- [Update Windows installation media with Dynamic Update](media-dynamic-update.md)
From a5475acc005510c2faf96bdba9efd3f963337815 Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Thu, 23 Jan 2025 11:31:55 -0800
Subject: [PATCH 07/86] ccu-9693727
---
windows/deployment/update/release-cycle.md | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/windows/deployment/update/release-cycle.md b/windows/deployment/update/release-cycle.md
index 2df0fe24ef..82e635558d 100644
--- a/windows/deployment/update/release-cycle.md
+++ b/windows/deployment/update/release-cycle.md
@@ -54,6 +54,14 @@ Monthly security update releases are available through the following channels:
Many update management tools, such as [Microsoft Configuration Manager](/mem/configmgr/) and [Microsoft Intune](/mem/intune/), rely on these channels for update deployment.
+Starting Windows 11, version 24H2, Microsoft may periodically release cumulative updates as checkpoints. The subsequent updates will consist of:
+- The update package files associated with the checkpoints, and
+- New update package files that contain incremental binary differentials against the version of binaries in the last checkpoint.
+
+Multiple checkpoints may be shipped during the lifecycle of a given Windows release. Devices updating from Windows Update and WSUS can continue to seamlessly install the latest monthly security update regardless of whether there are any preceding checkpoint cumulative updates, no change is needed to their update process. Catalog users can review [Checkpoint cumulative updates and Microsoft Update Catalog usage](catalog-checkpoint-cumulative-updates.md) for reference.
+
+
+
## Optional nonsecurity preview release
**Optional nonsecurity preview releases** provide IT admins an opportunity for early validation of that content prior to the **monthly security update release**. Admins can test and validate production-quality releases ahead of the planned monthly security update release for the following month. These updates are optional, cumulative, nonsecurity preview releases. New features might initially be deployed in the prior month's **optional nonsecurity preview release**, then ship in the following **monthly security update release**. **Optional nonsecurity preview releases** are typically released on the fourth Tuesday of the month at 10:00 AM Pacific Time (PST/PDT). These releases are only offered to the most recent, supported versions of Windows.
From 8c0f17456288528849486e3ee0fa7237f9365d7f Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Thu, 23 Jan 2025 11:35:56 -0800
Subject: [PATCH 08/86] ccu-9693727
---
windows/deployment/update/release-cycle.md | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/windows/deployment/update/release-cycle.md b/windows/deployment/update/release-cycle.md
index 82e635558d..c7c628ba1b 100644
--- a/windows/deployment/update/release-cycle.md
+++ b/windows/deployment/update/release-cycle.md
@@ -78,6 +78,12 @@ To access the optional nonsecurity preview release:
- Use [Windows Insider Program for Business](https://insider.windows.com/for-business)
- Use the [Microsoft Update Catalog](https://www.catalog.update.microsoft.com/Home.aspx).
+Starting Windows 11, version 24H2, Microsoft may periodically release cumulative updates as checkpoints. The subsequent updates will consist of:
+- The update package files associated with the checkpoints, and
+- New update package files that contain incremental binary differentials against the version of binaries in the last checkpoint.
+
+Multiple checkpoints may be shipped during the lifecycle of a given Windows release. Devices updating from Windows Update and WSUS can continue to seamlessly install the latest monthly security update regardless of whether there are any preceding checkpoint cumulative updates, no change is needed to their update process. Catalog users can review [Checkpoint cumulative updates and Microsoft Update Catalog usage](catalog-checkpoint-cumulative-updates.md) for reference.
+
## OOB releases
**Out-of-band (OOB) releases** might be provided to fix a recently identified issue or vulnerability. They're used in atypical cases when an issue is detected and can't wait for the next monthly release, because devices must be updated immediately to address security vulnerabilities or to resolve a quality issue impacting many devices. **Out-of-band (OOB) releases** are provided outside of the monthly schedule when there's an exceptional need.
From 618377a20d1cc9b6fa4c57cf58b841f0a4e7c536 Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Thu, 23 Jan 2025 11:37:59 -0800
Subject: [PATCH 09/86] ccu-9693727
---
windows/deployment/update/release-cycle.md | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/windows/deployment/update/release-cycle.md b/windows/deployment/update/release-cycle.md
index c7c628ba1b..266d95bfcf 100644
--- a/windows/deployment/update/release-cycle.md
+++ b/windows/deployment/update/release-cycle.md
@@ -11,7 +11,7 @@ ms.localizationpriority: medium
appliesto:
- ✅ Windows 11
- ✅ Windows 10
-ms.date: 06/04/2024
+ms.date: 01/23/2025
---
# Update release cycle for Windows clients
@@ -74,7 +74,7 @@ Multiple checkpoints may be shipped during the lifecycle of a given Windows rele
- LCU preview
To access the optional nonsecurity preview release:
-- Navigate to **Settings** > **Update & Security** > **Windows Update** and select **Check for updates**.
+- Navigate to **Settings** > **Update & Security** > **Windows Update** and select **Check for updates**.
- Use [Windows Insider Program for Business](https://insider.windows.com/for-business)
- Use the [Microsoft Update Catalog](https://www.catalog.update.microsoft.com/Home.aspx).
From 3c8cfb2a61edf741e908f9b38e27bb8ed3f854b6 Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Thu, 23 Jan 2025 13:54:40 -0800
Subject: [PATCH 10/86] ccu-9693727
---
.../catalog-checkpoint-cumulative-updates.md | 40 +++++++++----------
windows/deployment/update/release-cycle.md | 2 +-
2 files changed, 21 insertions(+), 21 deletions(-)
diff --git a/windows/deployment/update/catalog-checkpoint-cumulative-updates.md b/windows/deployment/update/catalog-checkpoint-cumulative-updates.md
index b6e802f722..9c930c27e2 100644
--- a/windows/deployment/update/catalog-checkpoint-cumulative-updates.md
+++ b/windows/deployment/update/catalog-checkpoint-cumulative-updates.md
@@ -17,9 +17,9 @@ ms.date: 01/23/2025
# Checkpoint cumulative updates and Microsoft Update Catalog usage
-Starting Windows 11, version 24H2, monthly security updates and optional nonsecurity preview release updates may be preceded by a checkpoint cumulative update (CU). Devices (and images) updating from Windows Update (WU) and Windows Server Update Services (WSUS) release channels can continue to seamlessly install the latest monthly security update or the optional nonsecurity preview release regardless of whether there are any preceding checkpoint CUs, so update processes involving WU and WSUS remain unchanged. This article covers how Catalog users can easily update their devices (or images) through checkpoint CUs.
+Starting Windows 11, version 24H2, monthly security updates and optional nonsecurity preview release updates may be preceded by a checkpoint cumulative update. Devices (and images) updating from Windows Update (WU) and Windows Server Update Services (WSUS) release channels can continue to seamlessly install the latest monthly security update or the optional nonsecurity preview release regardless of whether there are any preceding checkpoint cumulative updates, so update processes involving WU and WSUS remain unchanged. This article covers how Microsoft Update Catalog users can easily update their devices (or images) through checkpoint cumulative updates.
-## Checkpoint CUs
+## Checkpoint cumulative updates
Windows 11 quality updates use servicing technology and are built cumulatively from the time when a new Windows OS was "released to manufacturing" (RTM). These monthly updates include all the changes since RTM in the form of binary differentials computed from the initial version of those binaries.
@@ -31,63 +31,63 @@ Going forward, Microsoft might periodically release cumulative updates as checkp
This process may be repeated multiple times, thereby generating multiple checkpoints during the lifecycle of a given Windows release. The Windows 11, version 24H2 servicing stack can merge all the checkpoints and only download and install content that's missing on the device.
-If any checkpoint CUs precede a target update, a device or image needs to take all prior checkpoint CUs before it can take the target update. In other words, a post-checkpoint LCU can be applied to images/devices that are on that checkpoint or on a subsequent LCU. For updates sourced from WU and WSUS this happens seamlessly, and you can continue to use the same tools and processes that you currently use for approving and deploying updates.
+If any checkpoint cumulative updates precede a target update, a device or image needs to take all prior checkpoint cumulative updates before it can take the target update. In other words, a post-checkpoint latest cumulative update can be applied to images/devices that are on that checkpoint or on a subsequent latest cumulative update. For updates sourced from WU and WSUS this happens seamlessly, and you can continue to use the same tools and processes that you currently use for approving and deploying updates.
### Applicability
-A checkpoint CU is just another monthly security update that informs how subsequent updates are built. There is no policy change or new requirement around when users must take these updates, though it is best practice to take monthly security updates at the earliest opportunity to keep your devices protected and productive.
+A checkpoint cumulative update is just another monthly security update that informs how subsequent updates are built. There is no policy change or new requirement around when users must take these updates, though it is best practice to take monthly security updates at the earliest opportunity to keep your devices protected and productive.
This feature does not introduce any change to the applicability of monthly security updates. As before, these updates apply to the main OS (install.wim) and to WinPE (boot.wim) but not to WinRE (winre.wim).
-WinRE is serviced by applying the servicing stack update (SSU) from OnePackage (LCU does not apply) and SafeOS DU. This is how it has been for a while now, and there is no recent change to WinRE servicing and certainly no change due to the checkpoint cumulative updates feature. We understand that not everybody may have had a shared understanding about this, but applying SSU then SafeOS DU is the only way to ensure WinRE is serviced. For more information, see [Update Windows installation media with Dynamic Update](media-dynamic-update.md).
+WinRE is serviced by applying the servicing stack update from OnePackage (latest cumulative update does not apply) and SafeOS DU. This is how it has been for a while now, and there is no recent change to WinRE servicing and certainly no change due to the checkpoint cumulative updates feature. We understand that not everybody may have had a shared understanding about this, but applying servicing stack update then SafeOS DU is the only way to ensure WinRE is serviced. For more information, see [Update Windows installation media with Dynamic Update](media-dynamic-update.md).
-### Current Checkpoint CUs
+### Current checkpoint cumulative updates
-For Windows 11, version 24H2 and above, for a given update the knowledge base (KB) article will note all preceding checkpoint CUs under the **Catalog** release channel tab. We expect that your experience updating through a checkpoint CU will position you to efficiently take future checkpoint CUs.
+For Windows 11, version 24H2 and above, for a given update the knowledge base (KB) article will note all preceding checkpoint cumulative updates under the **Catalog** release channel tab. We expect that your experience updating through a checkpoint cumulative update will position you to efficiently take future checkpoint cumulative updates.
## Updating from the Microsoft Update Catalog
-When installing a given monthly security or optional nonsecurity preview update, [Microsoft Update Catalog](https://www.catalog.update.microsoft.com) users can determine and download the prior checkpoint CUs and apply these sequentially under certain situations or in one go using DISM.
+When installing a given monthly security or optional nonsecurity preview update, [Microsoft Update Catalog](https://www.catalog.update.microsoft.com) users can determine and download the prior checkpoint cumulative updates and apply these sequentially under certain situations or in one go using DISM.
-### Finding prior Checkpoint CUs
+### Finding prior checkpoint cumulative updates
-For a given update, users can look up the KB article and find all preceding checkpoints, if any, listed under the **Catalog** release channel. For instance, the 2024-12 monthly security update (KB5048667) has one preceding checkpoint CU per [December 10, 2024-KB5048667 (OS Build 26100.2605)](https://support.microsoft.com/topic/708755a6-d809-4a8a-8d20-53c4108590e6#ID0ELBD=Catalog):
+For a given update, users can look up the KB article and find all preceding checkpoints, if any, listed under the **Catalog** release channel. For instance, the 2024-12 monthly security update (KB5048667) has one preceding checkpoint cumulative update per [December 10, 2024-KB5048667 (OS Build 26100.2605)](https://support.microsoft.com/topic/708755a6-d809-4a8a-8d20-53c4108590e6#ID0ELBD=Catalog):
> Method 2: Install each MSU file individually, in order Download and install each MSU file individually either using DISM or [Windows Update Standalone Installer](https://support.microsoft.com/topic/799ba3df-ec7e-b05e-ee13-1cdae8f23b19) in the following order:
- windows11.0-kb5043080-x64_953449672073f8fb99badb4cc6d5d7849b9c83e8.msu
- windows11.0-kb5048667-x64_d4ad0ca69de9a02bc356757581e0e0d6960c9f93.msu
-Alternately, users can search the KB number in the [Microsoft Update Catalog](https://catalog.update.microsoft.com/) and select the **Download** button for the selected architecture. The download pop-up shows all prior checkpoints for the update so that users can conveniently download all MSUs and apply them to their image or device. For instance, Microsoft Update Catalog shows the [2024-12 cumulative update (KB5048667)](https://support.microsoft.com/help/5048667) has one preceding checkpoint CU, [KB5043080](https://support.microsoft.com/help/5043080).
+Alternately, users can search the KB number in the [Microsoft Update Catalog](https://catalog.update.microsoft.com/) and select the **Download** button for the selected architecture. The download pop-up shows all prior checkpoints for the update so that users can conveniently download all MSUs and apply them to their image or device. For instance, Microsoft Update Catalog shows the [2024-12 cumulative update (KB5048667)](https://support.microsoft.com/help/5048667) has one preceding checkpoint cumulative update, [KB5043080](https://support.microsoft.com/help/5043080).
-### Updating through Checkpoint CUs
+### Updating through checkpoint cumulative updates
-**Device has the latest checkpoint CU and doesn't need customization:**
+**Device has the latest checkpoint cumulative update and doesn't need customization:**
-Devices or images that have the latest checkpoint CU installed and do not need Features on Demand (FoD) or language pack (LP) customization can be updated to the latest target CU with no change to your existing process. You can simply copy the target MSU from Catalog and install it, for instance using [Add-WindowsPackage (DISM)](/powershell/module/dism/add-windowspackage) or [DISM operating system package (`.cab` or `.msu`) servicing command-line options](/windows-hardware/manufacture/desktop/dism-operating-system-package-servicing-command-line-options).
+Devices or images that have the latest checkpoint cumulative update installed and do not need Features on Demand (FoD) or language pack (LP) customization can be updated to the latest target cumulative update with no change to your existing process. You can simply copy the target MSU from Microsoft Update Catalog and install it, for instance using [Add-WindowsPackage (DISM)](/powershell/module/dism/add-windowspackage) or [DISM operating system package (`.cab` or `.msu`) servicing command-line options](/windows-hardware/manufacture/desktop/dism-operating-system-package-servicing-command-line-options).
Examples of eligible devices:
| Device is on | Needs to install|
|---|---|
-|- The checkpoint CU, 2024-09 (KB5043080)
|- A subsequent monthly security update like 2024-11 (KB5046617), or
- A subsequent optional nonsecurity releaselike 2024-11 (KB5046740)
|
+|- The checkpoint cumulative update, 2024-09 (KB5043080)
|- A subsequent monthly security update like 2024-11 (KB5046617), or
- A subsequent optional nonsecurity releaselike 2024-11 (KB5046740)
|
|- A subsequent optional nonsecurity preview release like 2024-09 (KB5043178), or
- A subsequent monthly security update like 2024-10 (KB5044284)
|- A subsequent monthly security update like 2025-01 (KB5050009), or
- A subsequent optional nonsecurity release like 2024-11 (KB5046740)
|
**Device needs FoD or LP customization:**
-Installing FoDs or LPs requires the full LCU payload, which now can be split across files associated with each preceding checkpoint CU. So, when customizing FoDs or LPs, all prior checkpoint CUs and the target CU need to be installed regardless of whether the device already had any of the prior checkpoints CU installed. This needs to be done using DISM.
+Installing FoDs or LPs requires the full latest cumulative update payload, which now can be split across files associated with each preceding checkpoint cumulative update. So, when customizing FoDs or LPs, all prior checkpoint cumulative updates and the target cumulative update need to be installed regardless of whether the device already had any of the prior checkpoints cumulative update installed. This needs to be done using DISM.
-1. Copy the MSUs of the latest CU (the target) and all prior checkpoint CUs to a local folder. Make sure there are no other MSUs present.
+1. Copy the MSUs of the latest cumulative update (the target) and all prior checkpoint cumulative updates to a local folder. Make sure there are no other MSUs present.
1. Mount the install.wim file.
1. Run `DISM /add-package` with the latest MSU as the sole target.
1. Run `/Cleanup-Image /StartComponentCleanup`.
1. Unmount.
1. Run `DISM /export-image` to optimize the image size, if that's important to you.
-**Device doesn't have the latest checkpoint CU and doesn't need customization:**
+**Device doesn't have the latest checkpoint cumulative update and doesn't need customization:**
-Devices that are not on the latest checkpoint CU and do not need FoD/LP customization can either install all needed CUs one by one in the right sequence. Alternately they can be updated using DISM to install all CUs in one go, see above. If there are total 4 checkpoint CUs available and device already has the first one installed, DISM will apply the remaining 3 checkpoint CUs in the right order followed by the target CU, all in one go.
+Devices that are not on the latest checkpoint cumulative update and do not need FoD/LP customization can either install all needed cumulative updates one by one in the right sequence. Alternately they can be updated using DISM to install all cumulative updates in one go, see above. If there are total 4 checkpoint cumulative updates available and device already has the first one installed, DISM will apply the remaining 3 checkpoint cumulative updates in the right order followed by the target cumulative update, all in one go.
## Related articles
- [Servicing stack updates](/windows/deployment/update/servicing-stack-updates)
- [Features on Demand](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities)
-- [How to download updates that include drivers and hotfixes from the Windows Update Catalog](/troubleshoot/windows-client/installing-updates-features-roles/download-updates-drivers-hotfixes-windows-update-catalog)
+- [How to download updates that include drivers and hotfixes from the Microsoft Update Catalog](/troubleshoot/windows-client/installing-updates-features-roles/download-updates-drivers-hotfixes-windows-update-catalog)
- [Update Windows installation media with Dynamic Update](media-dynamic-update.md)
diff --git a/windows/deployment/update/release-cycle.md b/windows/deployment/update/release-cycle.md
index 266d95bfcf..aa99ea62f3 100644
--- a/windows/deployment/update/release-cycle.md
+++ b/windows/deployment/update/release-cycle.md
@@ -1,6 +1,6 @@
---
title: Update release cycle for Windows clients
-description: Learn about the release cycle for updates so Windows clients in your organization stay productive and protected.
+description: Learn about the release cycle for updates so Windows clients in your organization stay productive and protected.
ms.service: windows-client
ms.subservice: itpro-updates
ms.topic: conceptual
From 379b99618c5695f67b63011ea9ea42b1a940aa79 Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Thu, 23 Jan 2025 14:04:17 -0800
Subject: [PATCH 11/86] ccu-9693727
---
.../catalog-checkpoint-cumulative-updates.md | 28 +++++++++----------
1 file changed, 14 insertions(+), 14 deletions(-)
diff --git a/windows/deployment/update/catalog-checkpoint-cumulative-updates.md b/windows/deployment/update/catalog-checkpoint-cumulative-updates.md
index 9c930c27e2..acabef6211 100644
--- a/windows/deployment/update/catalog-checkpoint-cumulative-updates.md
+++ b/windows/deployment/update/catalog-checkpoint-cumulative-updates.md
@@ -17,37 +17,37 @@ ms.date: 01/23/2025
# Checkpoint cumulative updates and Microsoft Update Catalog usage
-Starting Windows 11, version 24H2, monthly security updates and optional nonsecurity preview release updates may be preceded by a checkpoint cumulative update. Devices (and images) updating from Windows Update (WU) and Windows Server Update Services (WSUS) release channels can continue to seamlessly install the latest monthly security update or the optional nonsecurity preview release regardless of whether there are any preceding checkpoint cumulative updates, so update processes involving WU and WSUS remain unchanged. This article covers how Microsoft Update Catalog users can easily update their devices (or images) through checkpoint cumulative updates.
+Starting Windows 11, version 24H2, monthly security updates and optional nonsecurity preview release updates might be preceded by a checkpoint cumulative update. Devices (and images) updating from Windows Update (WU) and Windows Server Update Services (WSUS) release channels can continue to seamlessly install the latest monthly security update or the optional nonsecurity preview release regardless of whether there are any preceding checkpoint cumulative updates, so update processes involving WU and WSUS remain unchanged. This article covers how Microsoft Update Catalog users can easily update their devices (or images) through checkpoint cumulative updates.
## Checkpoint cumulative updates
-Windows 11 quality updates use servicing technology and are built cumulatively from the time when a new Windows OS was "released to manufacturing" (RTM). These monthly updates include all the changes since RTM in the form of binary differentials computed from the initial version of those binaries.
+Windows 11 quality updates use servicing technology and are built cumulatively from the time when a new Windows OS was released to manufacturing (RTM). These monthly updates include all the changes since RTM in the form of binary differentials computed from the initial version of those binaries.
-With Windows 11, version 24H2, Microsoft introduced a new concept of checkpoint cumulative updates. This will allow you to get features and security enhancements via the latest cumulative update through smaller, incremental differentials containing only the changes since the previous checkpoint cumulative update. This means that you can save time, bandwidth, and hard drive space.
+With Windows 11, version 24H2, Microsoft introduced a new concept of checkpoint cumulative updates. This change allows you to get features and security enhancements via the latest cumulative update through smaller, incremental differentials containing only the changes since the previous checkpoint cumulative update. This change means that you can save time, bandwidth, and hard drive space.
Going forward, Microsoft might periodically release cumulative updates as checkpoints. The subsequent updates will then consist of:
- The update package files associated with the checkpoints, and
- New update package files that contain incremental binary differentials against the version of binaries in the last checkpoint.
-This process may be repeated multiple times, thereby generating multiple checkpoints during the lifecycle of a given Windows release. The Windows 11, version 24H2 servicing stack can merge all the checkpoints and only download and install content that's missing on the device.
+This process might be repeated multiple times, thereby generating multiple checkpoints during the lifecycle of a given Windows release. The Windows 11, version 24H2 servicing stack can merge all the checkpoints and only download and install content that's missing on the device.
-If any checkpoint cumulative updates precede a target update, a device or image needs to take all prior checkpoint cumulative updates before it can take the target update. In other words, a post-checkpoint latest cumulative update can be applied to images/devices that are on that checkpoint or on a subsequent latest cumulative update. For updates sourced from WU and WSUS this happens seamlessly, and you can continue to use the same tools and processes that you currently use for approving and deploying updates.
+If any checkpoint cumulative updates precede a target update, a device or image needs to take all prior checkpoint cumulative updates before it can take the target update. In other words, a post-checkpoint latest cumulative update can be applied to images/devices that are on that checkpoint or on a subsequent latest cumulative update. For updates sourced from WU and WSUS this process happens seamlessly. You can continue to use the same tools and processes that you currently use for approving and deploying updates.
### Applicability
-A checkpoint cumulative update is just another monthly security update that informs how subsequent updates are built. There is no policy change or new requirement around when users must take these updates, though it is best practice to take monthly security updates at the earliest opportunity to keep your devices protected and productive.
+A checkpoint cumulative update is just another monthly security update that informs how subsequent updates are built. There's no policy change or new requirement around when users must take these updates, though it's best practice to take monthly security updates at the earliest opportunity to keep your devices protected and productive.
-This feature does not introduce any change to the applicability of monthly security updates. As before, these updates apply to the main OS (install.wim) and to WinPE (boot.wim) but not to WinRE (winre.wim).
+This feature doesn't introduce any change to the applicability of monthly security updates. As before, these updates apply to the main OS (install.wim) and to WinPE (boot.wim) but not to WinRE (winre.wim).
-WinRE is serviced by applying the servicing stack update from OnePackage (latest cumulative update does not apply) and SafeOS DU. This is how it has been for a while now, and there is no recent change to WinRE servicing and certainly no change due to the checkpoint cumulative updates feature. We understand that not everybody may have had a shared understanding about this, but applying servicing stack update then SafeOS DU is the only way to ensure WinRE is serviced. For more information, see [Update Windows installation media with Dynamic Update](media-dynamic-update.md).
+WinRE is serviced by applying the servicing stack update from OnePackage (latest cumulative update doesn't apply) and SafeOS Dynamic Update. This is how it has been for a while now, and there's no recent change to WinRE servicing and certainly no change due to the checkpoint cumulative updates feature. We understand that not everybody may have had a shared understanding about this, but applying servicing stack update then SafeOS Dynamic Update is the only way to ensure WinRE is serviced. For more information, see [Update Windows installation media with Dynamic Update](media-dynamic-update.md).
### Current checkpoint cumulative updates
-For Windows 11, version 24H2 and above, for a given update the knowledge base (KB) article will note all preceding checkpoint cumulative updates under the **Catalog** release channel tab. We expect that your experience updating through a checkpoint cumulative update will position you to efficiently take future checkpoint cumulative updates.
+For Windows 11, version 24H2 and later, for a given update the knowledge base (KB) article notes all preceding checkpoint cumulative updates under the **Catalog** release channel tab. We expect that your experience updating through a checkpoint cumulative update will position you to efficiently take future checkpoint cumulative updates.
## Updating from the Microsoft Update Catalog
-When installing a given monthly security or optional nonsecurity preview update, [Microsoft Update Catalog](https://www.catalog.update.microsoft.com) users can determine and download the prior checkpoint cumulative updates and apply these sequentially under certain situations or in one go using DISM.
+When installing a given monthly security or optional nonsecurity preview update, [Microsoft Update Catalog](https://www.catalog.update.microsoft.com) users can determine and download the prior checkpoint cumulative updates and apply them sequentially under certain situations or in one go using DISM.
### Finding prior checkpoint cumulative updates
@@ -61,20 +61,20 @@ Alternately, users can search the KB number in the [Microsoft Update Catalog](ht
**Device has the latest checkpoint cumulative update and doesn't need customization:**
-Devices or images that have the latest checkpoint cumulative update installed and do not need Features on Demand (FoD) or language pack (LP) customization can be updated to the latest target cumulative update with no change to your existing process. You can simply copy the target MSU from Microsoft Update Catalog and install it, for instance using [Add-WindowsPackage (DISM)](/powershell/module/dism/add-windowspackage) or [DISM operating system package (`.cab` or `.msu`) servicing command-line options](/windows-hardware/manufacture/desktop/dism-operating-system-package-servicing-command-line-options).
+Devices or images that have the latest checkpoint cumulative update installed and don't need Features on Demand (FoD) or language pack (LP) customization can be updated to the latest target cumulative update with no change to your existing process. You can copy the target MSU from Microsoft Update Catalog and install it, for instance using [Add-WindowsPackage (DISM)](/powershell/module/dism/add-windowspackage) or [DISM operating system package (`.cab` or `.msu`) servicing command-line options](/windows-hardware/manufacture/desktop/dism-operating-system-package-servicing-command-line-options).
Examples of eligible devices:
| Device is on | Needs to install|
|---|---|
-|- The checkpoint cumulative update, 2024-09 (KB5043080)
|- A subsequent monthly security update like 2024-11 (KB5046617), or
- A subsequent optional nonsecurity releaselike 2024-11 (KB5046740)
|
+|- The checkpoint cumulative update, 2024-09 (KB5043080)
|- A subsequent monthly security update like 2024-11 (KB5046617), or
- A subsequent optional nonsecurity release like 2024-11 (KB5046740)
|
|- A subsequent optional nonsecurity preview release like 2024-09 (KB5043178), or
- A subsequent monthly security update like 2024-10 (KB5044284)
|- A subsequent monthly security update like 2025-01 (KB5050009), or
- A subsequent optional nonsecurity release like 2024-11 (KB5046740)
|
**Device needs FoD or LP customization:**
Installing FoDs or LPs requires the full latest cumulative update payload, which now can be split across files associated with each preceding checkpoint cumulative update. So, when customizing FoDs or LPs, all prior checkpoint cumulative updates and the target cumulative update need to be installed regardless of whether the device already had any of the prior checkpoints cumulative update installed. This needs to be done using DISM.
-1. Copy the MSUs of the latest cumulative update (the target) and all prior checkpoint cumulative updates to a local folder. Make sure there are no other MSUs present.
+1. Copy the .msu files of the latest cumulative update (the target) and all prior checkpoint cumulative updates to a local folder. Make sure there are no other .msu files present.
1. Mount the install.wim file.
1. Run `DISM /add-package` with the latest MSU as the sole target.
1. Run `/Cleanup-Image /StartComponentCleanup`.
@@ -83,7 +83,7 @@ Installing FoDs or LPs requires the full latest cumulative update payload, which
**Device doesn't have the latest checkpoint cumulative update and doesn't need customization:**
-Devices that are not on the latest checkpoint cumulative update and do not need FoD/LP customization can either install all needed cumulative updates one by one in the right sequence. Alternately they can be updated using DISM to install all cumulative updates in one go, see above. If there are total 4 checkpoint cumulative updates available and device already has the first one installed, DISM will apply the remaining 3 checkpoint cumulative updates in the right order followed by the target cumulative update, all in one go.
+Devices that aren't on the latest checkpoint cumulative update and don't need FoD/LP customization can either install all needed cumulative updates one by one in the right sequence. Alternately they can be updated using DISM to install all cumulative updates in one go, see above. If there are total four checkpoint cumulative updates available and device already has the first one installed, DISM applies the remaining three checkpoint cumulative updates in the right order followed by the target cumulative update, all in one go.
## Related articles
From 39e1c81dd5a7b27f45798f36b3ba665d4ba077b6 Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Thu, 23 Jan 2025 15:11:33 -0800
Subject: [PATCH 12/86] ccu-9693727
---
windows/deployment/TOC.yml | 2 ++
.../catalog-checkpoint-cumulative-updates.md | 16 ++++++++--------
2 files changed, 10 insertions(+), 8 deletions(-)
diff --git a/windows/deployment/TOC.yml b/windows/deployment/TOC.yml
index e816d252d7..db0c863b4a 100644
--- a/windows/deployment/TOC.yml
+++ b/windows/deployment/TOC.yml
@@ -294,6 +294,8 @@ items:
href: update/windows-update-logs.md
- name: Servicing stack updates
href: update/servicing-stack-updates.md
+ - name: Checkpoint cumulative updates and Microsoft Update Catalog usage
+ href: update/catalog-checkpoint-cumulative-updates.md
- name: Update CSP policies
href: /windows/client-management/mdm/policy-csp-update?context=/windows/deployment/context/context
- name: Update other Microsoft products
diff --git a/windows/deployment/update/catalog-checkpoint-cumulative-updates.md b/windows/deployment/update/catalog-checkpoint-cumulative-updates.md
index acabef6211..c569bad856 100644
--- a/windows/deployment/update/catalog-checkpoint-cumulative-updates.md
+++ b/windows/deployment/update/catalog-checkpoint-cumulative-updates.md
@@ -43,11 +43,11 @@ WinRE is serviced by applying the servicing stack update from OnePackage (latest
### Current checkpoint cumulative updates
-For Windows 11, version 24H2 and later, for a given update the knowledge base (KB) article notes all preceding checkpoint cumulative updates under the **Catalog** release channel tab. We expect that your experience updating through a checkpoint cumulative update will position you to efficiently take future checkpoint cumulative updates.
+For Windows 11, version 24H2 and later, for a given update, the knowledge base (KB) article notes all preceding checkpoint cumulative updates under the **Catalog** release channel tab. We expect that your experience updating through a checkpoint cumulative update will position you to efficiently take future checkpoint cumulative updates.
## Updating from the Microsoft Update Catalog
-When installing a given monthly security or optional nonsecurity preview update, [Microsoft Update Catalog](https://www.catalog.update.microsoft.com) users can determine and download the prior checkpoint cumulative updates and apply them sequentially under certain situations or in one go using DISM.
+When installing a given monthly security or optional nonsecurity preview update, [Microsoft Update Catalog](https://www.catalog.update.microsoft.com) users can determine and download the prior checkpoint cumulative updates and apply them sequentially under certain situations, or in one go using Deployment Image Servicing and Management (DISM).
### Finding prior checkpoint cumulative updates
@@ -55,13 +55,13 @@ For a given update, users can look up the KB article and find all preceding chec
> Method 2: Install each MSU file individually, in order Download and install each MSU file individually either using DISM or [Windows Update Standalone Installer](https://support.microsoft.com/topic/799ba3df-ec7e-b05e-ee13-1cdae8f23b19) in the following order:
- windows11.0-kb5043080-x64_953449672073f8fb99badb4cc6d5d7849b9c83e8.msu
- windows11.0-kb5048667-x64_d4ad0ca69de9a02bc356757581e0e0d6960c9f93.msu
-Alternately, users can search the KB number in the [Microsoft Update Catalog](https://catalog.update.microsoft.com/) and select the **Download** button for the selected architecture. The download pop-up shows all prior checkpoints for the update so that users can conveniently download all MSUs and apply them to their image or device. For instance, Microsoft Update Catalog shows the [2024-12 cumulative update (KB5048667)](https://support.microsoft.com/help/5048667) has one preceding checkpoint cumulative update, [KB5043080](https://support.microsoft.com/help/5043080).
+Alternately, users can search the KB number in the [Microsoft Update Catalog](https://catalog.update.microsoft.com/) and select the **Download** button for the selected architecture. The download pop-up shows all prior checkpoints for the update so that users can conveniently download all `.msu` files and apply them to their image or device. For instance, Microsoft Update Catalog shows the [2024-12 cumulative update (KB5048667)](https://support.microsoft.com/help/5048667) has one preceding checkpoint cumulative update, [KB5043080](https://support.microsoft.com/help/5043080).
### Updating through checkpoint cumulative updates
**Device has the latest checkpoint cumulative update and doesn't need customization:**
-Devices or images that have the latest checkpoint cumulative update installed and don't need Features on Demand (FoD) or language pack (LP) customization can be updated to the latest target cumulative update with no change to your existing process. You can copy the target MSU from Microsoft Update Catalog and install it, for instance using [Add-WindowsPackage (DISM)](/powershell/module/dism/add-windowspackage) or [DISM operating system package (`.cab` or `.msu`) servicing command-line options](/windows-hardware/manufacture/desktop/dism-operating-system-package-servicing-command-line-options).
+Devices or images that have the latest checkpoint cumulative update installed and don't need Features on Demand (FoD) or language pack customization can be updated to the latest target cumulative update with no change to your existing process. You can copy the target `.msu` file from Microsoft Update Catalog and install it, for instance using [Add-WindowsPackage (DISM)](/powershell/module/dism/add-windowspackage) or [DISM operating system package (`.cab` or `.msu`) servicing command-line options](/windows-hardware/manufacture/desktop/dism-operating-system-package-servicing-command-line-options).
Examples of eligible devices:
@@ -70,20 +70,20 @@ Examples of eligible devices:
|- The checkpoint cumulative update, 2024-09 (KB5043080)
|- A subsequent monthly security update like 2024-11 (KB5046617), or
- A subsequent optional nonsecurity release like 2024-11 (KB5046740)
|
|- A subsequent optional nonsecurity preview release like 2024-09 (KB5043178), or
- A subsequent monthly security update like 2024-10 (KB5044284)
|- A subsequent monthly security update like 2025-01 (KB5050009), or
- A subsequent optional nonsecurity release like 2024-11 (KB5046740)
|
-**Device needs FoD or LP customization:**
+**Device needs FoD or language pack customization:**
-Installing FoDs or LPs requires the full latest cumulative update payload, which now can be split across files associated with each preceding checkpoint cumulative update. So, when customizing FoDs or LPs, all prior checkpoint cumulative updates and the target cumulative update need to be installed regardless of whether the device already had any of the prior checkpoints cumulative update installed. This needs to be done using DISM.
+Installing FoDs or language packs requires the full latest cumulative update payload, which now can be split across files associated with each preceding checkpoint cumulative update. So, when customizing FoDs or language packs, all prior checkpoint cumulative updates and the target cumulative update need to be installed regardless of whether the device already had any of the prior checkpoints cumulative update installed. This needs to be done using DISM.
1. Copy the .msu files of the latest cumulative update (the target) and all prior checkpoint cumulative updates to a local folder. Make sure there are no other .msu files present.
1. Mount the install.wim file.
-1. Run `DISM /add-package` with the latest MSU as the sole target.
+1. Run `DISM /add-package` with the latest `.msu` file as the sole target.
1. Run `/Cleanup-Image /StartComponentCleanup`.
1. Unmount.
1. Run `DISM /export-image` to optimize the image size, if that's important to you.
**Device doesn't have the latest checkpoint cumulative update and doesn't need customization:**
-Devices that aren't on the latest checkpoint cumulative update and don't need FoD/LP customization can either install all needed cumulative updates one by one in the right sequence. Alternately they can be updated using DISM to install all cumulative updates in one go, see above. If there are total four checkpoint cumulative updates available and device already has the first one installed, DISM applies the remaining three checkpoint cumulative updates in the right order followed by the target cumulative update, all in one go.
+Devices that aren't on the latest checkpoint cumulative update and don't need FoD/language pack customization can either install all needed cumulative updates one by one in the right sequence. Alternately they can be updated using DISM to install all cumulative updates in one go. For more information, see the [Updating through checkpoint cumulative updates](#updating-through-checkpoint-cumulative-updates) section. If there are total four checkpoint cumulative updates available and device already has the first one installed, DISM applies the remaining three checkpoint cumulative updates in the right order followed by the target cumulative update, all in one go.
## Related articles
From 61e0e38f59da8a9842ad1d1880712a5b5d135f35 Mon Sep 17 00:00:00 2001
From: Chris Olin
Date: Fri, 24 Jan 2025 11:37:24 -0500
Subject: [PATCH 13/86] Update pinned-apps.md
added key details for provisioning package configuration / expected syntax
---
windows/configuration/taskbar/pinned-apps.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/configuration/taskbar/pinned-apps.md b/windows/configuration/taskbar/pinned-apps.md
index d2454b1e79..6f93e76b25 100644
--- a/windows/configuration/taskbar/pinned-apps.md
+++ b/windows/configuration/taskbar/pinned-apps.md
@@ -193,7 +193,7 @@ Alternatively, you can configure devices using a [custom policy][MEM-1] with the
- **Value:** content of the XML file
> [!NOTE]
-> The content of the file must be entered as a single line in the `Value` field. Use a text editor to remove any line breaks from the XML file, usually with a function called *join lines*.
+> The content of the file must be entered as a single line in the `Value` field. Use a text editor to remove any line breaks from the XML file, usually with a function called *join lines* or *linearize*. If customizations.xml is being modified directly instead of using the WCD editor, the XML brackets need to be escaped / replaced with \< and \> entity encodings. Single and double quote characters do not need to be escaped.
[!INCLUDE [provisioning-package-2](../../../includes/configure/provisioning-package-2.md)]
From f814a24f965d8db9d463c375bbd7e2a1b115a5ef Mon Sep 17 00:00:00 2001
From: TCGL23 <140627881+TCGL23@users.noreply.github.com>
Date: Fri, 24 Jan 2025 17:41:58 +0000
Subject: [PATCH 14/86] Update bitlocker-csp.md
Updating as descriptions in CSP refer to AD DS yet when configured to backup to AD DS, Microsoft Entra hybrid joined devices, the BitLocker recovery password is backed up to both Active Directory and Entra ID. and Microsoft Entra joined devices, the BitLocker recovery password is backed up to Entra ID.
---
windows/client-management/mdm/bitlocker-csp.md | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/windows/client-management/mdm/bitlocker-csp.md b/windows/client-management/mdm/bitlocker-csp.md
index f4d06f4ce7..052ed1a825 100644
--- a/windows/client-management/mdm/bitlocker-csp.md
+++ b/windows/client-management/mdm/bitlocker-csp.md
@@ -551,6 +551,10 @@ The possible values for 'zz' are:
- 1 = Store recovery passwords and key packages
- 2 = Store recovery passwords only
+
+For Microsoft Entra hybrid joined devices, the BitLocker recovery password is backed up to both Active Directory and Entra ID.
+
+For Microsoft Entra joined devices, the BitLocker recovery password is backed up to Entra ID.
@@ -2092,6 +2096,10 @@ The possible values for 'zz' are:
- 1 = Store recovery passwords and key packages.
- 2 = Store recovery passwords only.
+
+For Microsoft Entra hybrid joined devices, the BitLocker recovery password is backed up to both Active Directory and Entra ID.
+
+For Microsoft Entra joined devices, the BitLocker recovery password is backed up to Entra ID.
From 871071ea651124af44c2acd42050d87bb17888ff Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Fri, 24 Jan 2025 11:10:40 -0800
Subject: [PATCH 15/86] edits from pm
---
.../update/catalog-checkpoint-cumulative-updates.md | 6 +++---
windows/deployment/update/release-cycle.md | 6 +++---
2 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/windows/deployment/update/catalog-checkpoint-cumulative-updates.md b/windows/deployment/update/catalog-checkpoint-cumulative-updates.md
index c569bad856..3d038d8a0a 100644
--- a/windows/deployment/update/catalog-checkpoint-cumulative-updates.md
+++ b/windows/deployment/update/catalog-checkpoint-cumulative-updates.md
@@ -12,12 +12,12 @@ ms.collection:
ms.localizationpriority: medium
appliesto:
- ✅ Windows 11, version 24H2 and later
-ms.date: 01/23/2025
+ms.date: 01/27/2025
---
# Checkpoint cumulative updates and Microsoft Update Catalog usage
-Starting Windows 11, version 24H2, monthly security updates and optional nonsecurity preview release updates might be preceded by a checkpoint cumulative update. Devices (and images) updating from Windows Update (WU) and Windows Server Update Services (WSUS) release channels can continue to seamlessly install the latest monthly security update or the optional nonsecurity preview release regardless of whether there are any preceding checkpoint cumulative updates, so update processes involving WU and WSUS remain unchanged. This article covers how Microsoft Update Catalog users can easily update their devices (or images) through checkpoint cumulative updates.
+Starting Windows 11, version 24H2, monthly security updates and optional nonsecurity preview release updates might be preceded by a checkpoint cumulative update. Devices (and images) updating from Windows Update (WU) and Windows Server Update Services (WSUS) release channels can continue to seamlessly install the latest monthly security update or the optional nonsecurity preview release regardless of whether there are any preceding checkpoint cumulative updates, so **update processes involving WU and WSUS remain unchanged**. This article covers how Microsoft Update Catalog users can easily update their devices (or images) through checkpoint cumulative updates.
## Checkpoint cumulative updates
@@ -39,7 +39,7 @@ A checkpoint cumulative update is just another monthly security update that info
This feature doesn't introduce any change to the applicability of monthly security updates. As before, these updates apply to the main OS (install.wim) and to WinPE (boot.wim) but not to WinRE (winre.wim).
-WinRE is serviced by applying the servicing stack update from OnePackage (latest cumulative update doesn't apply) and SafeOS Dynamic Update. This is how it has been for a while now, and there's no recent change to WinRE servicing and certainly no change due to the checkpoint cumulative updates feature. We understand that not everybody may have had a shared understanding about this, but applying servicing stack update then SafeOS Dynamic Update is the only way to ensure WinRE is serviced. For more information, see [Update Windows installation media with Dynamic Update](media-dynamic-update.md).
+WinRE is serviced by applying the servicing stack update from a cumulative update (latest cumulative update doesn't apply) and SafeOS Dynamic Update. This is how it has been for a while now, and there's no recent change to WinRE servicing and certainly no change due to the checkpoint cumulative updates feature. We understand that not everybody may have had a shared understanding about this, but applying servicing stack update then SafeOS Dynamic Update is the only way to ensure WinRE is serviced. For more information, see [Update Windows installation media with Dynamic Update](media-dynamic-update.md).
### Current checkpoint cumulative updates
diff --git a/windows/deployment/update/release-cycle.md b/windows/deployment/update/release-cycle.md
index aa99ea62f3..7df3d99935 100644
--- a/windows/deployment/update/release-cycle.md
+++ b/windows/deployment/update/release-cycle.md
@@ -11,7 +11,7 @@ ms.localizationpriority: medium
appliesto:
- ✅ Windows 11
- ✅ Windows 10
-ms.date: 01/23/2025
+ms.date: 01/27/2025
---
# Update release cycle for Windows clients
@@ -58,7 +58,7 @@ Starting Windows 11, version 24H2, Microsoft may periodically release cumulative
- The update package files associated with the checkpoints, and
- New update package files that contain incremental binary differentials against the version of binaries in the last checkpoint.
-Multiple checkpoints may be shipped during the lifecycle of a given Windows release. Devices updating from Windows Update and WSUS can continue to seamlessly install the latest monthly security update regardless of whether there are any preceding checkpoint cumulative updates, no change is needed to their update process. Catalog users can review [Checkpoint cumulative updates and Microsoft Update Catalog usage](catalog-checkpoint-cumulative-updates.md) for reference.
+Multiple checkpoints may be shipped during the lifecycle of a given Windows release. Devices updating from Windows Update and WSUS can continue to seamlessly install the latest monthly security update regardless of whether there are any preceding checkpoint cumulative updates, **no change is needed to their update process**. Catalog users can review [Checkpoint cumulative updates and Microsoft Update Catalog usage](catalog-checkpoint-cumulative-updates.md) for reference.
@@ -82,7 +82,7 @@ Starting Windows 11, version 24H2, Microsoft may periodically release cumulative
- The update package files associated with the checkpoints, and
- New update package files that contain incremental binary differentials against the version of binaries in the last checkpoint.
-Multiple checkpoints may be shipped during the lifecycle of a given Windows release. Devices updating from Windows Update and WSUS can continue to seamlessly install the latest monthly security update regardless of whether there are any preceding checkpoint cumulative updates, no change is needed to their update process. Catalog users can review [Checkpoint cumulative updates and Microsoft Update Catalog usage](catalog-checkpoint-cumulative-updates.md) for reference.
+Multiple checkpoints may be shipped during the lifecycle of a given Windows release. Devices updating from Windows Update and WSUS can continue to seamlessly install the latest monthly security update regardless of whether there are any preceding checkpoint cumulative updates, **no change is needed to their update process**. Catalog users can review [Checkpoint cumulative updates and Microsoft Update Catalog usage](catalog-checkpoint-cumulative-updates.md) for reference.
## OOB releases
From 750aa34feffcb2209449d3d33aeee9db07573698 Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Fri, 24 Jan 2025 11:41:49 -0800
Subject: [PATCH 16/86] edits from pm
---
.../deployment/update/catalog-checkpoint-cumulative-updates.md | 1 +
1 file changed, 1 insertion(+)
diff --git a/windows/deployment/update/catalog-checkpoint-cumulative-updates.md b/windows/deployment/update/catalog-checkpoint-cumulative-updates.md
index 3d038d8a0a..a537aea3fa 100644
--- a/windows/deployment/update/catalog-checkpoint-cumulative-updates.md
+++ b/windows/deployment/update/catalog-checkpoint-cumulative-updates.md
@@ -12,6 +12,7 @@ ms.collection:
ms.localizationpriority: medium
appliesto:
- ✅ Windows 11, version 24H2 and later
+ - ✅ Windows Server 2025
ms.date: 01/27/2025
---
From d8c6f3453149dd9bc68732d312b7ad464765b2d2 Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Mon, 27 Jan 2025 08:23:08 -0800
Subject: [PATCH 17/86] cpw-9694988
---
windows/client-management/manage-windows-copilot.md | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/windows/client-management/manage-windows-copilot.md b/windows/client-management/manage-windows-copilot.md
index fdb5c9671f..c899d98a8e 100644
--- a/windows/client-management/manage-windows-copilot.md
+++ b/windows/client-management/manage-windows-copilot.md
@@ -59,9 +59,9 @@ For users signing in to new PCs with work or school accounts, the following expe
The update to Microsoft 365 Copilot Chat to offer enterprise data protection is rolling out now.
The shift to Microsoft 365 Copilot Chat is coming soon. Changes will be rolled out to managed PCs starting with the September 2024 optional nonsecurity preview release, and following with the October 2024 monthly security update for all supported versions of Windows 11. These changes will be applied to Windows 10 PCs the month after. This update is replacing the current Copilot in Windows experience.
-The Microsoft 365 Copilot app will be automatically enabled after you install the Windows updates listed above if you haven't previously enabled a group policy to prevent the installation of Copilot. The [AppLocker policy](/windows/security/application-security/application-control/app-control-for-business/applocker/applocker-overview) is available to control this Copilot experience before installing these Windows updates mentioned above or any subsequent Windows updates.
+The Microsoft Copilot app, which is a consumer experience, will be automatically enabled after you install the Windows updates listed above if you haven't previously enabled a group policy to prevent the installation of Copilot. The [AppLocker policy](/windows/security/application-security/application-control/app-control-for-business/applocker/applocker-overview) is available to control this Copilot experience before installing these Windows updates mentioned above or any subsequent Windows updates.
-Note that the Microsoft 365 Copilot app doesn't support Microsoft Entra authentication and users trying to sign in to the app using a Microsoft Entra account will be redirected to https://copilot.cloud.microsoft/ in their default browser. For users authenticating with a Microsoft Entra account, they should access Copilot through the Microsoft 365 Copilot app as the entry point. We recommend you pin Copilot to the navigation bar of the Microsoft 365 Copilot app to enable easy access.
+Note that the Microsoft Copilot app doesn't support Microsoft Entra authentication and users trying to sign in to the app using a Microsoft Entra account will be redirected to https://copilot.cloud.microsoft/ in their default browser. For users authenticating with a Microsoft Entra account, they should access Copilot through the Microsoft 365 Copilot app as the entry point. We recommend you pin Copilot to the navigation bar of the Microsoft 365 Copilot app to enable easy access.
## Policy information for previous Copilot in Windows (preview) experience
From c01e4d1591ef7bb7b762a3cf69dacbab341f24b6 Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Mon, 27 Jan 2025 08:27:33 -0800
Subject: [PATCH 18/86] cpw-9694988
---
windows/client-management/manage-windows-copilot.md | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/windows/client-management/manage-windows-copilot.md b/windows/client-management/manage-windows-copilot.md
index c899d98a8e..5014d53399 100644
--- a/windows/client-management/manage-windows-copilot.md
+++ b/windows/client-management/manage-windows-copilot.md
@@ -59,9 +59,9 @@ For users signing in to new PCs with work or school accounts, the following expe
The update to Microsoft 365 Copilot Chat to offer enterprise data protection is rolling out now.
The shift to Microsoft 365 Copilot Chat is coming soon. Changes will be rolled out to managed PCs starting with the September 2024 optional nonsecurity preview release, and following with the October 2024 monthly security update for all supported versions of Windows 11. These changes will be applied to Windows 10 PCs the month after. This update is replacing the current Copilot in Windows experience.
-The Microsoft Copilot app, which is a consumer experience, will be automatically enabled after you install the Windows updates listed above if you haven't previously enabled a group policy to prevent the installation of Copilot. The [AppLocker policy](/windows/security/application-security/application-control/app-control-for-business/applocker/applocker-overview) is available to control this Copilot experience before installing these Windows updates mentioned above or any subsequent Windows updates.
+The Microsoft Copilot app will be automatically enabled after you install the Windows updates listed above if you haven't previously enabled a group policy to prevent the installation of Copilot. The [AppLocker policy](/windows/security/application-security/application-control/app-control-for-business/applocker/applocker-overview) is available to control this Copilot experience before installing these Windows updates mentioned above or any subsequent Windows updates.
-Note that the Microsoft Copilot app doesn't support Microsoft Entra authentication and users trying to sign in to the app using a Microsoft Entra account will be redirected to https://copilot.cloud.microsoft/ in their default browser. For users authenticating with a Microsoft Entra account, they should access Copilot through the Microsoft 365 Copilot app as the entry point. We recommend you pin Copilot to the navigation bar of the Microsoft 365 Copilot app to enable easy access.
+Note that the Microsoft Copilot app, which is a consumer experience, doesn't support Microsoft Entra authentication and users trying to sign in to the app using a Microsoft Entra account will be redirected to https://copilot.cloud.microsoft/ in their default browser. For users authenticating with a Microsoft Entra account, they should access Copilot through the Microsoft 365 Copilot app as the entry point. We recommend you pin Copilot to the navigation bar of the Microsoft 365 Copilot app to enable easy access.
## Policy information for previous Copilot in Windows (preview) experience
From 3a5da118ae2635ad17409b3a3c93f4f6c672dd29 Mon Sep 17 00:00:00 2001
From: "Steve DiAcetis (MSFT)"
<52939067+SteveDiAcetis@users.noreply.github.com>
Date: Mon, 27 Jan 2025 11:12:40 -0800
Subject: [PATCH 19/86] Update media-dynamic-update.md
Due to changes in how optional components are implemented, we are moving the installation of these before the final LCU install. This means cleanup may fail with a warning. Further, other changes include:
1) Moving some script comments into the main article, to improve readability. Most of this is related to the old approach where SSU was a separate update.
2) Adding Optional Components (or Legacy Features) to the script. This help ensure they are showcased before the LCU install.
3) Tweaked the main table of steps, to highlight SSU is coming from LCU, and the sequence change with main OS cleanup.
---
.../deployment/update/media-dynamic-update.md | 350 +++++++++---------
1 file changed, 171 insertions(+), 179 deletions(-)
diff --git a/windows/deployment/update/media-dynamic-update.md b/windows/deployment/update/media-dynamic-update.md
index e5b5cd4a0b..511f9384c1 100644
--- a/windows/deployment/update/media-dynamic-update.md
+++ b/windows/deployment/update/media-dynamic-update.md
@@ -13,7 +13,7 @@ appliesto:
- ✅ Windows 11
- ✅ Windows 10
- ✅ Windows Server
-ms.date: 11/11/2024
+ms.date: 1/28/2024
---
# Update Windows installation media with Dynamic Update
@@ -124,27 +124,27 @@ Properly updating the installation media involves many actions operating on seve
This table shows the correct sequence for applying the various tasks to the files. For example, the full sequence starts with adding the servicing stack update to WinRE (1) and concludes with adding boot manager from WinPE to the new media (28).
-|Task |WinRE (winre.wim) |Operating system (install.wim) | WinPE (boot.wim) | New media |
-|-------------------------------------------|-------------------|--------------------------------|------------------|-----------|
-|Add servicing stack Dynamic Update | 1 | 9 | 17 | |
-|Add language pack | 2 | 10 | 18 | |
-|Add localized optional packages | 3 | | 19 | |
-|Add font support | 4 | | 20 | |
-|Add text-to-speech | 5 | | 21 | |
-|Update Lang.ini | | | 22 | |
-|Add Features on Demand | | 11 | | |
-|Add Safe OS Dynamic Update | 6 | | | |
-|Add Setup Dynamic Update | | | | 26 |
-|Add setup.exe and setuphost.exe from WinPE | | | | 27 |
-|Add boot manager from WinPE | | | | 28 |
-|Add latest cumulative update | | 12 | 23 | |
-|Clean up the image | 7 | 13 | 24 | |
-|Add Optional Components | | 14 | | |
-|Add .NET and .NET cumulative updates | | 15 | | |
-|Export image | 8 | 16 | 25 | |
+|Task |WinRE (winre.wim) |Operating system (install.wim) | WinPE (boot.wim) | New media |
+|--------------------------------------------------------|-------------------|--------------------------------|------------------|-----------|
+|Add servicing stack update via latest cumulative update | 1 | 9 | 17 | |
+|Add language pack | 2 | 10 | 18 | |
+|Add localized optional packages | 3 | | 19 | |
+|Add font support | 4 | | 20 | |
+|Add text-to-speech | 5 | | 21 | |
+|Update Lang.ini | | | 22 | |
+|Add Features on Demand | | 11 | | |
+|Add Optional Components | | 12 | | |
+|Add Safe OS Dynamic Update | 6 | | | |
+|Add Setup Dynamic Update | | | | 26 |
+|Add setup.exe and setuphost.exe from WinPE | | | | 27 |
+|Add boot manager from WinPE | | | | 28 |
+|Add latest cumulative update | | 13 | 23 | |
+|Clean up the image | 7 | 14 | 24 | |
+|Add .NET and .NET cumulative updates | | 15 | | |
+|Export image | 8 | 16 | 25 | |
> [!NOTE]
-> Starting in February 2021, the latest cumulative update and servicing stack update will be combined and distributed in the Microsoft Update Catalog as a new combined cumulative update. For Steps 1, 9, and 18 that require the servicing stack update for updating the installation media, you should use the combined cumulative update. For more information on the combined cumulative update, see [Servicing stack updates](./servicing-stack-updates.md).
+> Starting in February 2021, the latest cumulative update and servicing stack update is combined and distributed in the Microsoft Update Catalog as a new combined cumulative update. For Steps 1, 9, and 17 that require the servicing stack update for updating the installation media, you should use the combined cumulative update. For more information on the combined cumulative update, see [Servicing stack updates](./servicing-stack-updates.md).
> [!NOTE]
> Microsoft will remove the Flash component from Windows through KB4577586, "Update for Removal of Adobe Flash Player". You can also remove Flash anytime by deploying the update in KB4577586 (available on the Catalog) between steps 20 and 21. As of July 2021, KB4577586, "Update for Removal of Adobe Flash Player" will be included in the latest cumulative update for Windows 10, versions 1607 and 1507. The update will also be included in the Monthly Rollup and the Security Only Update for Windows 8.1, Windows Server 2012, and Windows Embedded 8 Standard. For more information, see [Update on Adobe Flash Player End of Support](https://blogs.windows.com/msedgedev/2020/09/04/update-adobe-flash-end-support/).
@@ -178,7 +178,8 @@ These examples are for illustration only, and therefore lack error handling. The
### Get started
-The script starts by declaring global variables and creating folders to use for mounting images. Then, make a copy of the original media, from \oldMedia to \newMedia, keeping the original media in case there's a script error and it's necessary to start over from a known state. Also, it provides a comparison of old versus new media to evaluate changes. To ensure that the new media updates, make sure they aren't read-only.
+The script starts by declaring global variables and creating folders to use for mounting images. Then, make a copy of the original media, from \oldMedia to \newMedia, keeping the original media in case there's a script error and it's necessary to start over from a known state. Also, it provides a comparison of old versus new media to evaluate changes. To ensure that the new media updates, make sure they aren't read-only. The script also showcases adding additional languages, Features on Demand, and Optional Components. These are not required, but added to highlight when in the sequence they should be addeed. Starting with Windows 11, version 21H2, the language pack (LANGPACK) ISO has been superseded by the FOD ISO. Language packs and the \Windows Preinstallation Environment packages are part of the LOF ISO. Further, the path for main OS language and optional features moved to \LanguagesAndOptionalFeatures instead of the root. If you are using this script for Windows 10, modify to mount and use the LANGPACK ISO.
+
```powershell
#Requires -RunAsAdministrator
@@ -187,40 +188,38 @@ function Get-TS { return "{0:HH:mm:ss}" -f [DateTime]::Now }
Write-Output "$(Get-TS): Starting media refresh"
-# Declare language for showcasing adding optional localized components
-$LANG = "ja-jp"
-$LANG_FONT_CAPABILITY = "jpan"
-
-# Declare media for FOD and LPs
-# Note: Starting with Windows 11, version 21H2, the language pack (LANGPACK) ISO has been superseded by the FOD ISO.
-# Language packs and the \Windows Preinstallation Environment packages are part of the LOF ISO.
-# If you are using this script for Windows 10, modify to mount and use the LANGPACK ISO.
-$FOD_ISO_PATH = "C:\mediaRefresh\packages\FOD-PACKAGES_OEM_PT1_amd64fre_MULTI.iso"
-
# Declare Dynamic Update packages. A dedicated folder is used for the latest cumulative update, and as needed
# checkpoint cumulative updates.
$LCU_PATH = "C:\mediaRefresh\packages\CU\LCU.msu"
-$SSU_PATH = "C:\mediaRefresh\packages\Other\SSU_DU.msu"
$SETUP_DU_PATH = "C:\mediaRefresh\packages\Other\Setup_DU.cab"
$SAFE_OS_DU_PATH = "C:\mediaRefresh\packages\Other\SafeOS_DU.cab"
$DOTNET_CU_PATH = "C:\mediaRefresh\packages\Other\DotNet_CU.msu"
-# Declare folders for mounted images and temp files
-$MEDIA_OLD_PATH = "C:\mediaRefresh\oldMedia"
-$MEDIA_NEW_PATH = "C:\mediaRefresh\newMedia"
-$WORKING_PATH = "C:\mediaRefresh\temp"
-$MAIN_OS_MOUNT = "C:\mediaRefresh\temp\MainOSMount"
-$WINRE_MOUNT = "C:\mediaRefresh\temp\WinREMount"
-$WINPE_MOUNT = "C:\mediaRefresh\temp\WinPEMount"
+# Declare media for FOD and LPs
+$FOD_ISO_PATH = "C:\mediaRefresh\packages\CLIENT_LOF_PACKAGES_OEM.iso"
+
+# Array of Features On Demand for main OS
+# This is optional to showcase where these are added
+$FOD = @(
+'XPS.Viewer~~~~0.0.1.0'
+)
+
+# Array of Legacy Features for main OS
+# This is optional to showcase where these are added
+$OC = @(
+'MediaPlayback'
+'WindowsMediaPlayer'
+)
# Mount the Features on Demand ISO
Write-Output "$(Get-TS): Mounting FOD ISO"
$FOD_ISO_DRIVE_LETTER = (Mount-DiskImage -ImagePath $FOD_ISO_PATH -ErrorAction stop | Get-Volume).DriveLetter
-
-# Note: Starting with Windows 11, version 21H2, the correct path for main OS language and optional features
-# moved to \LanguagesAndOptionalFeatures instead of the root. For Windows 10, use $FOD_PATH = $FOD_ISO_DRIVE_LETTER + ":\"
$FOD_PATH = $FOD_ISO_DRIVE_LETTER + ":\LanguagesAndOptionalFeatures"
+# Declare language for showcasing adding optional localized components
+$LANG = "ja-jp"
+$LANG_FONT_CAPABILITY = "jpan"
+
# Declare language related cabs
$WINPE_OC_PATH = "$FOD_ISO_DRIVE_LETTER`:\Windows Preinstallation Environment\x64\WinPE_OCs"
$WINPE_OC_LANG_PATH = "$WINPE_OC_PATH\$LANG"
@@ -231,6 +230,14 @@ $WINPE_SPEECH_TTS_PATH = "$WINPE_OC_PATH\WinPE-Speech-TTS.cab"
$WINPE_SPEECH_TTS_LANG_PATH = "$WINPE_OC_PATH\WinPE-Speech-TTS-$LANG.cab"
$OS_LP_PATH = "$FOD_PATH\Microsoft-Windows-Client-Language-Pack_x64_$LANG.cab"
+# Declare folders for mounted images and temp files
+$MEDIA_OLD_PATH = "C:\mediaRefresh\oldMedia\Ge\client_professional_en-us"
+$MEDIA_NEW_PATH = "C:\mediaRefresh\newMedia"
+$WORKING_PATH = "C:\mediaRefresh\temp"
+$MAIN_OS_MOUNT = "C:\mediaRefresh\temp\MainOSMount"
+$WINRE_MOUNT = "C:\mediaRefresh\temp\WinREMount"
+$WINPE_MOUNT = "C:\mediaRefresh\temp\WinPEMount"
+
# Create folders for mounting images and storing temporary files
New-Item -ItemType directory -Path $WORKING_PATH -ErrorAction Stop | Out-Null
New-Item -ItemType directory -Path $MAIN_OS_MOUNT -ErrorAction stop | Out-Null
@@ -241,15 +248,16 @@ New-Item -ItemType directory -Path $WINPE_MOUNT -ErrorAction stop | Out-Null
Write-Output "$(Get-TS): Copying original media to new media path"
Copy-Item -Path $MEDIA_OLD_PATH"\*" -Destination $MEDIA_NEW_PATH -Force -Recurse -ErrorAction stop | Out-Null
Get-ChildItem -Path $MEDIA_NEW_PATH -Recurse | Where-Object { -not $_.PSIsContainer -and $_.IsReadOnly } | ForEach-Object { $_.IsReadOnly = $false }
+
```
### Update WinRE and each main OS Windows edition
The script will update each edition of Windows within the main operating system file (install.wim). For each edition, the main OS image is mounted.
-For the first image, Winre.wim is copied to the working folder, and mounted. It then applies servicing stack Dynamic Update, since its components are used for updating other components. Since the script is optionally adding Japanese, it adds the language pack to the image, and installs the Japanese versions of all optional packages already installed in Winre.wim. Then, it applies the Safe OS Dynamic Update package. It finishes by cleaning and exporting the image to reduce the image size.
+For the first image, Winre.wim is copied to the working folder, and mounted. It then applies servicing stack servicing stack via the latest cumulative update, since its components are used for updating other components. Depending on the Windows release that you are updating, there are two different approaches for updating the servicing stack. The first approach is to use the combined cumulative update. This is for Windows releases that are shipping a combined cumulative update that includes the servicing stack updates (i.e. SSU + LCU are combined). Windows 11, version 21H2 and Windows 11, version 22H2 are examples. In these cases, the servicing stack update is not published seperately; the combined cumulative update should be used for this step. However, in hopefully rare cases, there may breaking change in the combined cumulative update format change, that requires a standalone servicing stack update to be published, and installed first before the combined cumulative update can be installed. Since the script is optionally adding Japanese, it adds the language pack to the image, and installs the Japanese versions of all optional packages already installed in Winre.wim. Then, it applies the Safe OS Dynamic Update package. It finishes by cleaning and exporting the image to reduce the image size.
-Next, for the mounted OS image, the script starts by applying the servicing stack Dynamic Update. Then, it adds Japanese language support and then the Japanese language features. Unlike the Dynamic Update packages, it uses `Add-WindowsCapability` to add these features. For a full list of such features, and their associated capability name, see [Available Features on Demand](/windows-hardware/manufacture/desktop/features-on-demand-non-language-fod). Now is the time to enable other Optional Components or add other Features on Demand. If such a feature has an associated cumulative update (for example, .NET), this is the time to apply those. The script then proceeds with applying the latest cumulative update. Finally, the script cleans and exports the image. You can install Optional Components, along with the .NET feature, offline, but that requires the device to be restarted. This is why the script installs .NET and Optional Components after cleanup and before export.
+Next, for the mounted OS image, the script starts by applying the servicing stack via the latest cumulative update. Then, it adds Japanese language support and then the Japanese language features. Unlike the Dynamic Update packages, it uses `Add-WindowsCapability` to add these features. For a full list of such features, and their associated capability name, see [Available Features on Demand](/windows-hardware/manufacture/desktop/features-on-demand-non-language-fod). Now is the time to enable other Optional Components or add other Features on Demand. If such a feature has an associated cumulative update (for example, .NET), this is the time to apply those. The script then attempts to clean the image, then a final step to apply the latest cumulative update. It is important to apply the latest cumulative update last, to ensure Features on Demand, Optional Components and Languages are updated from their initial release state. The .NET feature is an exception, that is added along with its cumulative update next. Finally, the script exports the image.
This process is repeated for each edition of Windows within the main operating system file. To reduce size, the serviced Winre.wim file from the first image is saved, and used to update each subsequent Windows edition. This reduces the final size of install.wim.
@@ -262,13 +270,15 @@ This process is repeated for each edition of Windows within the main operating s
# Get the list of images contained within the main OS
$WINOS_IMAGES = Get-WindowsImage -ImagePath $MEDIA_NEW_PATH"\sources\install.wim"
-Foreach ($IMAGE in $WINOS_IMAGES) {
+Foreach ($IMAGE in $WINOS_IMAGES)
+{
# first mount the main OS image
Write-Output "$(Get-TS): Mounting main OS, image index $($IMAGE.ImageIndex)"
Mount-WindowsImage -ImagePath $MEDIA_NEW_PATH"\sources\install.wim" -Index $IMAGE.ImageIndex -Path $MAIN_OS_MOUNT -ErrorAction stop| Out-Null
- if ($IMAGE.ImageIndex -eq "1") {
+ if ($IMAGE.ImageIndex -eq "1")
+ {
#
# update Windows Recovery Environment (WinRE) within this OS image
@@ -278,29 +288,9 @@ Foreach ($IMAGE in $WINOS_IMAGES) {
Mount-WindowsImage -ImagePath $WORKING_PATH"\winre.wim" -Index 1 -Path $WINRE_MOUNT -ErrorAction stop | Out-Null
# Add servicing stack update (Step 1 from the table)
-
- # Depending on the Windows release that you are updating, there are 2 different approaches for updating the servicing stack
- # The first approach is to use the combined cumulative update. This is for Windows releases that are shipping a combined
- # cumulative update that includes the servicing stack updates (i.e. SSU + LCU are combined). Windows 11, version 21H2 and
- # Windows 11, version 22H2 are examples. In these cases, the servicing stack update is not published seperately; the combined
- # cumulative update should be used for this step. However, in hopefully rare cases, there may breaking change in the combined
- # cumulative update format, that requires a standalone servicing stack update to be published, and installed first before the
- # combined cumulative update can be installed.
-
- # This is the code to handle the rare case that the SSU is published and required for the combined cumulative update
- # Write-Output "$(Get-TS): Adding package $SSU_PATH"
- # Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $SSU_PATH | Out-Null
-
- # Now, attempt the combined cumulative update.
- # There is a known issue where the servicing stack update is installed, but the cumulative update will fail. This error should
- # be caught and ignored, as the last step will be to apply the Safe OS update and thus the image will be left with the correct
- # packages installed.
-
-
Write-Output "$(Get-TS): Adding package $LCU_PATH to WinRE"
try
{
-
Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $LCU_PATH | Out-Null
}
Catch
@@ -308,38 +298,36 @@ Foreach ($IMAGE in $WINOS_IMAGES) {
$theError = $_
Write-Output "$(Get-TS): $theError"
- if ($theError.Exception -like "*0x8007007e*") {
- Write-Output "$(Get-TS): This failure is a known issue with combined cumulative update, we can ignore."
+ if ($theError.Exception -like "*0x8007007e*")
+ {
+ Write-Warning "$(Get-TS): Failed with error 0x8007007e. This failure is a known issue with combined cumulative update, we can ignore."
}
- else {
+ else
+ {
throw
}
}
- # The second approach for Step 1 is for Windows releases that have not adopted the combined cumulative update
- # but instead continue to have a seperate servicing stack update published. In this case, we'll install the SSU
- # update. This second approach is commented out below.
-
- # Write-Output "$(Get-TS): Adding package $SSU_PATH"
- # Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $SSU_PATH | Out-Null
-
#
# Optional: Add the language to recovery environment
#
+
# Install lp.cab cab
Write-Output "$(Get-TS): Adding package $WINPE_OC_LP_PATH to WinRE"
Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $WINPE_OC_LP_PATH -ErrorAction stop | Out-Null
# Install language cabs for each optional package installed
$WINRE_INSTALLED_OC = Get-WindowsPackage -Path $WINRE_MOUNT
- Foreach ($PACKAGE in $WINRE_INSTALLED_OC) {
-
- if ( ($PACKAGE.PackageState -eq "Installed") -and ($PACKAGE.PackageName.startsWith("WinPE-")) -and ($PACKAGE.ReleaseType -eq "FeaturePack") ) {
-
+ Foreach ($PACKAGE in $WINRE_INSTALLED_OC)
+ {
+ if ( ($PACKAGE.PackageState -eq "Installed") -and ($PACKAGE.PackageName.startsWith("WinPE-")) -and ($PACKAGE.ReleaseType -eq "FeaturePack") )
+ {
$INDEX = $PACKAGE.PackageName.IndexOf("-Package")
- if ($INDEX -ge 0) {
+ if ($INDEX -ge 0)
+ {
$OC_CAB = $PACKAGE.PackageName.Substring(0, $INDEX) + "_" + $LANG + ".cab"
- if ($WINPE_OC_LANG_CABS.Contains($OC_CAB)) {
+ if ($WINPE_OC_LANG_CABS.Contains($OC_CAB))
+ {
$OC_CAB_PATH = Join-Path $WINPE_OC_LANG_PATH $OC_CAB
Write-Output "$(Get-TS): Adding package $OC_CAB_PATH to WinRE"
Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $OC_CAB_PATH -ErrorAction stop | Out-Null
@@ -349,15 +337,17 @@ Foreach ($IMAGE in $WINOS_IMAGES) {
}
# Add font support for the new language
- if ( (Test-Path -Path $WINPE_FONT_SUPPORT_PATH) ) {
+ if ( (Test-Path -Path $WINPE_FONT_SUPPORT_PATH) )
+ {
Write-Output "$(Get-TS): Adding package $WINPE_FONT_SUPPORT_PATH to WinRE"
Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $WINPE_FONT_SUPPORT_PATH -ErrorAction stop | Out-Null
}
# Add TTS support for the new language
- if (Test-Path -Path $WINPE_SPEECH_TTS_PATH) {
- if ( (Test-Path -Path $WINPE_SPEECH_TTS_LANG_PATH) ) {
-
+ if (Test-Path -Path $WINPE_SPEECH_TTS_PATH)
+ {
+ if ( (Test-Path -Path $WINPE_SPEECH_TTS_LANG_PATH) )
+ {
Write-Output "$(Get-TS): Adding package $WINPE_SPEECH_TTS_PATH to WinRE"
Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $WINPE_SPEECH_TTS_PATH -ErrorAction stop | Out-Null
@@ -373,6 +363,10 @@ Foreach ($IMAGE in $WINOS_IMAGES) {
# Perform image cleanup
Write-Output "$(Get-TS): Performing image cleanup on WinRE"
DISM /image:$WINRE_MOUNT /cleanup-image /StartComponentCleanup /ResetBase /Defer | Out-Null
+ if ($LastExitCode -ne 0)
+ {
+ throw "Error: Failed to perform image cleanup on WinRE. Exit code: $LastExitCode"
+ }
# Dismount
Dismount-WindowsImage -Path $WINRE_MOUNT -Save -ErrorAction stop | Out-Null
@@ -389,35 +383,15 @@ Foreach ($IMAGE in $WINOS_IMAGES) {
# update Main OS
#
- # Add servicing stack update (Step 18 from the table)
-
- # Depending on the Windows release that you are updating, there are 2 different approaches for updating the servicing stack
- # The first approach is to use the combined cumulative update. This is for Windows releases that are shipping a combined cumulative update that
- # includes the servicing stack updates (i.e. SSU + LCU are combined). Windows 11, version 21H2 and Windows 11, version 22H2 are examples. In these
- # cases, the servicing stack update is not published seperately; the combined cumulative update should be used for this step. However, in hopefully
- # rare cases, there may breaking change in the combined cumulative update format, that requires a standalone servicing stack update to be published,
- # and installed first before the combined cumulative update can be installed.
-
- # This is the code to handle the rare case that the SSU is published and required for the combined cumulative update
- # Write-Output "$(Get-TS): Adding package $SSU_PATH"
- # Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $SSU_PATH | Out-Null
-
- # Now, attempt the combined cumulative update. Unlike WinRE and WinPE, we don't need to check for error 0x8007007e
+ # Add servicing stack update (Step 17 from the table). Unlike WinRE and WinPE, we don't need to check for error 0x8007007e
Write-Output "$(Get-TS): Adding package $LCU_PATH to main OS, index $($IMAGE.ImageIndex)"
Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $LCU_PATH | Out-Null
- # The second approach for Step 18 is for Windows releases that have not adopted the combined cumulative update
- # but instead continue to have a seperate servicing stack update published. In this case, we'll install the SSU
- # update. This second approach is commented out below.
- # Write-Output "$(Get-TS): Adding package $SSU_PATH to main OS, index $($IMAGE.ImageIndex)"
- # Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $SSU_PATH | Out-Null
-
- # Optional: Add language to main OS
+ # Optional: Add language to main OS and corresponding language experience Features on Demand
Write-Output "$(Get-TS): Adding package $OS_LP_PATH to main OS, index $($IMAGE.ImageIndex)"
Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $OS_LP_PATH -ErrorAction stop | Out-Null
- # Optional: Add a Features on Demand to the image
Write-Output "$(Get-TS): Adding language FOD: Language.Fonts.Jpan~~~und-JPAN~0.0.1.0 to main OS, index $($IMAGE.ImageIndex)"
Add-WindowsCapability -Name "Language.Fonts.$LANG_FONT_CAPABILITY~~~und-$LANG_FONT_CAPABILITY~0.0.1.0" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null
@@ -436,22 +410,47 @@ Foreach ($IMAGE in $WINOS_IMAGES) {
Write-Output "$(Get-TS): Adding language FOD: Language.Speech~~~$LANG~0.0.1.0 to main OS, index $($IMAGE.ImageIndex)"
Add-WindowsCapability -Name "Language.Speech~~~$LANG~0.0.1.0" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null
- # Note: If I wanted to enable additional Features on Demand, I'd add these here.
+ # Optional: Add additional Features On Demand
+ For ( $index = 0; $index -lt $FOD.count; $index++)#
+ {
+ Write-Output "$(Get-TS): Adding $($FOD[$index]) to main OS, index $($IMAGE.ImageIndex)"
+ Add-WindowsCapability -Name $($FOD[$index]) -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null
+ }
+
+ # Optional: Add Legacy Features
+ For ( $index = 0; $index -lt $OC.count; $index++)
+ {
+ Write-Output "$(Get-TS): Adding $($OC[$index]) to main OS, index $($IMAGE.ImageIndex)"
+ DISM /Image:$MAIN_OS_MOUNT /Enable-Feature /FeatureName:$($OC[$index]) /All | Out-Null
+ if ($LastExitCode -ne 0)
+ {
+ throw "Error: Failed to add $($OC[$index]) to main OS, index $($IMAGE.ImageIndex). Exit code: $LastExitCode"
+ }
+ }
# Add latest cumulative update
Write-Output "$(Get-TS): Adding package $LCU_PATH to main OS, index $($IMAGE.ImageIndex)"
Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $LCU_PATH -ErrorAction stop | Out-Null
- # Perform image cleanup
+ # Perform image cleanup. Some Optional Components might require the image to be booted, and thus
+ # image cleanup may fail. We'll catch and handle as a warning.
Write-Output "$(Get-TS): Performing image cleanup on main OS, index $($IMAGE.ImageIndex)"
DISM /image:$MAIN_OS_MOUNT /cleanup-image /StartComponentCleanup | Out-Null
+ if ($LastExitCode -ne 0)
+ {
+ if ($LastExitCode -eq -2146498554)
+ {
+ # We hit 0x800F0806 CBS_E_PENDING. We will ignore this with a warning
+ # This is likely due to legacy components being added that require online operations.
+ Write-Warning "$(Get-TS): Failed to perform image cleanup on main OS, index $($IMAGE.ImageIndex). Exit code: $LastExitCode. The operation cannot be performed until pending servicing operations are completed. The image must be booted to complete the pending servicing operation."
+ }
+ else
+ {
+ throw "Error: Failed to perform image cleanup on main OS, index $($IMAGE.ImageIndex). Exit code: $LastExitCode"
+ }
+ }
- #
- # Note: If I wanted to enable additional Optional Components, I'd add these here.
- # In addition, we'll add .NET 3.5 here as well. Both .NET and Optional Components might require
- # the image to be booted, and thus if we tried to cleanup after installation, it would fail.
- #
-
+ # Finally, we'll add .NET 3.5 and the .NET cumulative update
Write-Output "$(Get-TS): Adding NetFX3~~~~ to main OS, index $($IMAGE.ImageIndex)"
Add-WindowsCapability -Name "NetFX3~~~~" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null
@@ -465,7 +464,6 @@ Foreach ($IMAGE in $WINOS_IMAGES) {
# Export
Write-Output "$(Get-TS): Exporting image to $WORKING_PATH\install2.wim"
Export-WindowsImage -SourceImagePath $MEDIA_NEW_PATH"\sources\install.wim" -SourceIndex $IMAGE.ImageIndex -DestinationImagePath $WORKING_PATH"\install2.wim" -ErrorAction stop | Out-Null
-
}
Move-Item -Path $WORKING_PATH"\install2.wim" -Destination $MEDIA_NEW_PATH"\sources\install.wim" -Force -ErrorAction stop | Out-Null
@@ -484,31 +482,14 @@ This script is similar to the one that updates WinRE, but instead it mounts Boot
# Get the list of images contained within WinPE
$WINPE_IMAGES = Get-WindowsImage -ImagePath $MEDIA_NEW_PATH"\sources\boot.wim"
-Foreach ($IMAGE in $WINPE_IMAGES) {
+Foreach ($IMAGE in $WINPE_IMAGES)
+{
# update WinPE
Write-Output "$(Get-TS): Mounting WinPE, image index $($IMAGE.ImageIndex)"
Mount-WindowsImage -ImagePath $MEDIA_NEW_PATH"\sources\boot.wim" -Index $IMAGE.ImageIndex -Path $WINPE_MOUNT -ErrorAction stop | Out-Null
# Add servicing stack update (Step 9 from the table)
-
- # Depending on the Windows release that you are updating, there are 2 different approaches for updating the servicing stack
- # The first approach is to use the combined cumulative update. This is for Windows releases that are shipping a combined
- # cumulative update that includes the servicing stack updates (i.e. SSU + LCU are combined). Windows 11, version 21H2 and
- # Windows 11, version 22H2 are examples. In these cases, the servicing stack update is not published separately; the combined
- # cumulative update should be used for this step. However, in hopefully rare cases, there may breaking change in the combined
- # cumulative update format, that requires a standalone servicing stack update to be published, and installed first before the
- # combined cumulative update can be installed.
-
- # This is the code to handle the rare case that the SSU is published and required for the combined cumulative update
- # Write-Output "$(Get-TS): Adding package $SSU_PATH"
- # Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $SSU_PATH | Out-Null
-
- # Now, attempt the combined cumulative update.
- # There is a known issue where the servicing stack update is installed, but the cumulative update will fail.
- # This error should be caught and ignored, as the last step will be to apply the cumulative update
- # (or in this case the combined cumulative update) and thus the image will be left with the correct packages installed.
-
try
{
Write-Output "$(Get-TS): Adding package $LCU_PATH to WinPE, image index $($IMAGE.ImageIndex)"
@@ -518,38 +499,34 @@ Foreach ($IMAGE in $WINPE_IMAGES) {
{
$theError = $_
Write-Output "$(Get-TS): $theError"
-
- if ($theError.Exception -like "*0x8007007e*") {
- Write-Output "$(Get-TS): This failure is a known issue with combined cumulative update, we can ignore."
+ if ($theError.Exception -like "*0x8007007e*")
+ {
+ Write-Warning "$(Get-TS): Failed with error 0x8007007e. This failure is a known issue with combined cumulative update, we can ignore."
}
- else {
+ else
+ {
throw
}
}
- # The second approach for Step 9 is for Windows releases that have not adopted the combined cumulative update
- # but instead continue to have a separate servicing stack update published. In this case, we'll install the SSU
- # update. This second approach is commented out below.
-
- # Write-Output "$(Get-TS): Adding package $SSU_PATH"
- # Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $SSU_PATH | Out-Null
-
# Install lp.cab cab
Write-Output "$(Get-TS): Adding package $WINPE_OC_LP_PATH to WinPE, image index $($IMAGE.ImageIndex)"
Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $WINPE_OC_LP_PATH -ErrorAction stop | Out-Null
# Install language cabs for each optional package installed
$WINPE_INSTALLED_OC = Get-WindowsPackage -Path $WINPE_MOUNT
- Foreach ($PACKAGE in $WINPE_INSTALLED_OC) {
-
- if ( ($PACKAGE.PackageState -eq "Installed") -and ($PACKAGE.PackageName.startsWith("WinPE-")) -and ($PACKAGE.ReleaseType -eq "FeaturePack") ) {
-
+ Foreach ($PACKAGE in $WINPE_INSTALLED_OC)
+ {
+ if ( ($PACKAGE.PackageState -eq "Installed") -and ($PACKAGE.PackageName.startsWith("WinPE-")) -and ($PACKAGE.ReleaseType -eq "FeaturePack") )
+ {
$INDEX = $PACKAGE.PackageName.IndexOf("-Package")
- if ($INDEX -ge 0) {
-
+ if ($INDEX -ge 0)
+ {
$OC_CAB = $PACKAGE.PackageName.Substring(0, $INDEX) + "_" + $LANG + ".cab"
- if ($WINPE_OC_LANG_CABS.Contains($OC_CAB)) {
+ if ($WINPE_OC_LANG_CABS.Contains($OC_CAB))
+ {
$OC_CAB_PATH = Join-Path $WINPE_OC_LANG_PATH $OC_CAB
+
Write-Output "$(Get-TS): Adding package $OC_CAB_PATH to WinPE, image index $($IMAGE.ImageIndex)"
Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $OC_CAB_PATH -ErrorAction stop | Out-Null
}
@@ -558,15 +535,17 @@ Foreach ($IMAGE in $WINPE_IMAGES) {
}
# Add font support for the new language
- if ( (Test-Path -Path $WINPE_FONT_SUPPORT_PATH) ) {
+ if ( (Test-Path -Path $WINPE_FONT_SUPPORT_PATH) )
+ {
Write-Output "$(Get-TS): Adding package $WINPE_FONT_SUPPORT_PATH to WinPE, image index $($IMAGE.ImageIndex)"
Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $WINPE_FONT_SUPPORT_PATH -ErrorAction stop | Out-Null
}
# Add TTS support for the new language
- if (Test-Path -Path $WINPE_SPEECH_TTS_PATH) {
- if ( (Test-Path -Path $WINPE_SPEECH_TTS_LANG_PATH) ) {
-
+ if (Test-Path -Path $WINPE_SPEECH_TTS_PATH)
+ {
+ if ( (Test-Path -Path $WINPE_SPEECH_TTS_LANG_PATH) )
+ {
Write-Output "$(Get-TS): Adding package $WINPE_SPEECH_TTS_PATH to WinPE, image index $($IMAGE.ImageIndex)"
Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $WINPE_SPEECH_TTS_PATH -ErrorAction stop | Out-Null
@@ -576,9 +555,14 @@ Foreach ($IMAGE in $WINPE_IMAGES) {
}
# Generates a new Lang.ini file which is used to define the language packs inside the image
- if ( (Test-Path -Path $WINPE_MOUNT"\sources\lang.ini") ) {
+ if ( (Test-Path -Path $WINPE_MOUNT"\sources\lang.ini") )
+ {
Write-Output "$(Get-TS): Updating lang.ini"
DISM /image:$WINPE_MOUNT /Gen-LangINI /distribution:$WINPE_MOUNT | Out-Null
+ if ($LastExitCode -ne 0)
+ {
+ throw "Error: Failed to update lang.ini. Exit code: $LastExitCode"
+ }
}
# Add latest cumulative update
@@ -588,28 +572,31 @@ Foreach ($IMAGE in $WINPE_IMAGES) {
# Perform image cleanup
Write-Output "$(Get-TS): Performing image cleanup on WinPE, image index $($IMAGE.ImageIndex)"
DISM /image:$WINPE_MOUNT /cleanup-image /StartComponentCleanup /ResetBase /Defer | Out-Null
+ if ($LastExitCode -ne 0)
+ {
+ throw "Error: Failed to perform image cleanup on WinPE, image index $($IMAGE.ImageIndex). Exit code: $LastExitCode"
+ }
- if ($IMAGE.ImageIndex -eq "2") {
-
+ if ($IMAGE.ImageIndex -eq "2")
+ {
# Save setup.exe for later use. This will address possible binary mismatch with the version in the main OS \sources folder
Copy-Item -Path $WINPE_MOUNT"\sources\setup.exe" -Destination $WORKING_PATH"\setup.exe" -Force -ErrorAction stop | Out-Null
# Save setuphost.exe for later use. This will address possible binary mismatch with the version in the main OS \sources folder
# This is only required starting with Windows 11 version 24H2
$TEMP = Get-WindowsImage -ImagePath $MEDIA_NEW_PATH"\sources\boot.wim" -Index $IMAGE.ImageIndex
- if ([System.Version]$TEMP.Version -ge [System.Version]"10.0.26100") {
-
+ if ([System.Version]$TEMP.Version -ge [System.Version]"10.0.26100")
+ {
Copy-Item -Path $WINPE_MOUNT"\sources\setuphost.exe" -Destination $WORKING_PATH"\setuphost.exe" -Force -ErrorAction stop | Out-Null
}
- else {
-
+ else
+ {
Write-Output "$(Get-TS): Skipping copy of setuphost.exe; image version $($TEMP.Version)"
}
# Save serviced boot manager files later copy to the root media.
Copy-Item -Path $WINPE_MOUNT"\Windows\boot\efi\bootmgfw.efi" -Destination $WORKING_PATH"\bootmgfw.efi" -Force -ErrorAction stop | Out-Null
Copy-Item -Path $WINPE_MOUNT"\Windows\boot\efi\bootmgr.efi" -Destination $WORKING_PATH"\bootmgr.efi" -Force -ErrorAction stop | Out-Null
-
}
# Dismount
@@ -618,10 +605,10 @@ Foreach ($IMAGE in $WINPE_IMAGES) {
#Export WinPE
Write-Output "$(Get-TS): Exporting image to $WORKING_PATH\boot2.wim"
Export-WindowsImage -SourceImagePath $MEDIA_NEW_PATH"\sources\boot.wim" -SourceIndex $IMAGE.ImageIndex -DestinationImagePath $WORKING_PATH"\boot2.wim" -ErrorAction stop | Out-Null
-
}
Move-Item -Path $WORKING_PATH"\boot2.wim" -Destination $MEDIA_NEW_PATH"\sources\boot.wim" -Force -ErrorAction stop | Out-Null
+
```
### Update remaining media files
@@ -636,14 +623,18 @@ This part of the script updates the Setup files. It simply copies the individual
# Add Setup DU by copy the files from the package into the newMedia
Write-Output "$(Get-TS): Adding package $SETUP_DU_PATH"
cmd.exe /c $env:SystemRoot\System32\expand.exe $SETUP_DU_PATH -F:* $MEDIA_NEW_PATH"\sources" | Out-Null
+if ($LastExitCode -ne 0)
+{
+ throw "Error: Failed to expand $SETUP_DU_PATH. Exit code: $LastExitCode"
+}
# Copy setup.exe from boot.wim, saved earlier.
Write-Output "$(Get-TS): Copying $WORKING_PATH\setup.exe to $MEDIA_NEW_PATH\sources\setup.exe"
Copy-Item -Path $WORKING_PATH"\setup.exe" -Destination $MEDIA_NEW_PATH"\sources\setup.exe" -Force -ErrorAction stop | Out-Null
# Copy setuphost.exe from boot.wim, saved earlier.
-if (Test-Path -Path $WORKING_PATH"\setuphost.exe") {
-
+if (Test-Path -Path $WORKING_PATH"\setuphost.exe")
+{
Write-Output "$(Get-TS): Copying $WORKING_PATH\setuphost.exe to $MEDIA_NEW_PATH\sources\setuphost.exe"
Copy-Item -Path $WORKING_PATH"\setuphost.exe" -Destination $MEDIA_NEW_PATH"\sources\setuphost.exe" -Force -ErrorAction stop | Out-Null
}
@@ -651,28 +642,20 @@ if (Test-Path -Path $WORKING_PATH"\setuphost.exe") {
# Copy bootmgr files from boot.wim, saved earlier.
$MEDIA_NEW_FILES = Get-ChildItem $MEDIA_NEW_PATH -Force -Recurse -Filter b*.efi
-Foreach ($File in $MEDIA_NEW_FILES){
+Foreach ($File in $MEDIA_NEW_FILES)
+{
if (($File.Name -ieq "bootmgfw.efi") -or ($File.Name -ieq "bootx64.efi") -or ($File.Name -ieq "bootia32.efi") -or ($File.Name -ieq "bootaa64.efi"))
{
-
Write-Output "$(Get-TS): Copying $WORKING_PATH\bootmgfw.efi to $($File.FullName)"
Copy-Item -Path $WORKING_PATH"\bootmgfw.efi" -Destination $File.FullName -Force -ErrorAction stop | Out-Null
}
elseif ($File.Name -ieq "bootmgr.efi")
{
-
Write-Output "$(Get-TS): Copying $WORKING_PATH\bootmgr.efi to $($File.FullName)"
Copy-Item -Path $WORKING_PATH"\bootmgr.efi" -Destination $File.FullName -Force -ErrorAction stop | Out-Null
}
}
-```
-
-### Finish up
-
-As a last step, the script removes the working folder of temporary files, and unmounts our language pack and Features on Demand ISOs.
-
-```powershell
#
# Perform final cleanup
#
@@ -685,4 +668,13 @@ Write-Output "$(Get-TS): Dismounting ISO images"
Dismount-DiskImage -ImagePath $FOD_ISO_PATH -ErrorAction stop | Out-Null
Write-Output "$(Get-TS): Media refresh completed!"
+
+```
+
+### Finish up
+
+As a last step, the script removes the working folder of temporary files, and unmounts our language pack and Features on Demand ISOs.
+
+```powershell
+TODO
```
From 094d415c7a865a6ecbc9d12bce15cf42a2847035 Mon Sep 17 00:00:00 2001
From: "Steve DiAcetis (MSFT)"
<52939067+SteveDiAcetis@users.noreply.github.com>
Date: Mon, 27 Jan 2025 11:27:28 -0800
Subject: [PATCH 20/86] Update media-dynamic-update.md
---
windows/deployment/update/media-dynamic-update.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/deployment/update/media-dynamic-update.md b/windows/deployment/update/media-dynamic-update.md
index 511f9384c1..1e669a15c7 100644
--- a/windows/deployment/update/media-dynamic-update.md
+++ b/windows/deployment/update/media-dynamic-update.md
@@ -178,7 +178,7 @@ These examples are for illustration only, and therefore lack error handling. The
### Get started
-The script starts by declaring global variables and creating folders to use for mounting images. Then, make a copy of the original media, from \oldMedia to \newMedia, keeping the original media in case there's a script error and it's necessary to start over from a known state. Also, it provides a comparison of old versus new media to evaluate changes. To ensure that the new media updates, make sure they aren't read-only. The script also showcases adding additional languages, Features on Demand, and Optional Components. These are not required, but added to highlight when in the sequence they should be addeed. Starting with Windows 11, version 21H2, the language pack (LANGPACK) ISO has been superseded by the FOD ISO. Language packs and the \Windows Preinstallation Environment packages are part of the LOF ISO. Further, the path for main OS language and optional features moved to \LanguagesAndOptionalFeatures instead of the root. If you are using this script for Windows 10, modify to mount and use the LANGPACK ISO.
+The script starts by declaring global variables and creating folders to use for mounting images. Then, make a copy of the original media, from \oldMedia to \newMedia, keeping the original media in case there's a script error and it's necessary to start over from a known state. Also, it provides a comparison of old versus new media to evaluate changes. To ensure that the new media updates, make sure they aren't read-only. The script also showcases adding additional languages, Features on Demand, and Optional Components. These are not required, but added to highlight when in the sequence they should be addeed. Starting with Windows 11, version 21H2, the language pack (LANGPACK) ISO has been superseded by the Features on Demand ISO. Language packs and the \Windows Preinstallation Environment packages are part of the Features on Demand ISO. Further, the path for main OS language and optional features moved to \LanguagesAndOptionalFeatures instead of the root. If you are using this script for Windows 10, modify to mount and use the language pack (LANGPACK) ISO.
```powershell
From 2fe8a6231bbd70eabef20c231d1566e9be081931 Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Mon, 27 Jan 2025 12:35:34 -0800
Subject: [PATCH 21/86] cpw-9694988
---
windows/client-management/toc.yml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/client-management/toc.yml b/windows/client-management/toc.yml
index 711bc21aea..955dee1921 100644
--- a/windows/client-management/toc.yml
+++ b/windows/client-management/toc.yml
@@ -48,7 +48,7 @@ items:
href: enterprise-app-management.md
- name: Manage updates
href: device-update-management.md
- - name: Updated Windows and Microsoft Copilot experience
+ - name: Updated Windows and Microsoft 365 Copilot Chat experience
href: manage-windows-copilot.md
- name: Manage Recall
href: manage-recall.md
From a149e3de7b255fb9a6fd740658184702d1186860 Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Mon, 27 Jan 2025 12:37:17 -0800
Subject: [PATCH 22/86] cpw-9694988
---
windows/client-management/manage-windows-copilot.md | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/windows/client-management/manage-windows-copilot.md b/windows/client-management/manage-windows-copilot.md
index 5014d53399..2af6627e8d 100644
--- a/windows/client-management/manage-windows-copilot.md
+++ b/windows/client-management/manage-windows-copilot.md
@@ -59,9 +59,9 @@ For users signing in to new PCs with work or school accounts, the following expe
The update to Microsoft 365 Copilot Chat to offer enterprise data protection is rolling out now.
The shift to Microsoft 365 Copilot Chat is coming soon. Changes will be rolled out to managed PCs starting with the September 2024 optional nonsecurity preview release, and following with the October 2024 monthly security update for all supported versions of Windows 11. These changes will be applied to Windows 10 PCs the month after. This update is replacing the current Copilot in Windows experience.
-The Microsoft Copilot app will be automatically enabled after you install the Windows updates listed above if you haven't previously enabled a group policy to prevent the installation of Copilot. The [AppLocker policy](/windows/security/application-security/application-control/app-control-for-business/applocker/applocker-overview) is available to control this Copilot experience before installing these Windows updates mentioned above or any subsequent Windows updates.
+The Copilot app will be automatically enabled after you install the Windows updates listed above if you haven't previously enabled a group policy to prevent the installation of Copilot. The [AppLocker policy](/windows/security/application-security/application-control/app-control-for-business/applocker/applocker-overview) is available to control this Copilot experience before installing these Windows updates mentioned above or any subsequent Windows updates.
-Note that the Microsoft Copilot app, which is a consumer experience, doesn't support Microsoft Entra authentication and users trying to sign in to the app using a Microsoft Entra account will be redirected to https://copilot.cloud.microsoft/ in their default browser. For users authenticating with a Microsoft Entra account, they should access Copilot through the Microsoft 365 Copilot app as the entry point. We recommend you pin Copilot to the navigation bar of the Microsoft 365 Copilot app to enable easy access.
+Note that the Copilot app, which is a consumer experience, doesn't support Microsoft Entra authentication and users trying to sign in to the app using a Microsoft Entra account will be redirected to https://copilot.cloud.microsoft/ in their default browser. For users authenticating with a Microsoft Entra account, they should access Copilot through the Microsoft 365 Copilot app as the entry point. We recommend you pin Copilot to the navigation bar of the Microsoft 365 Copilot app to enable easy access.
## Policy information for previous Copilot in Windows (preview) experience
From 9bd82cce5f826a981939db7ae8c967548b50ea6c Mon Sep 17 00:00:00 2001
From: "Steve DiAcetis (MSFT)"
<52939067+SteveDiAcetis@users.noreply.github.com>
Date: Mon, 27 Jan 2025 13:36:06 -0800
Subject: [PATCH 23/86] Update media-dynamic-update.md
---
windows/deployment/update/media-dynamic-update.md | 15 +++++++--------
1 file changed, 7 insertions(+), 8 deletions(-)
diff --git a/windows/deployment/update/media-dynamic-update.md b/windows/deployment/update/media-dynamic-update.md
index 1e669a15c7..0ae148a631 100644
--- a/windows/deployment/update/media-dynamic-update.md
+++ b/windows/deployment/update/media-dynamic-update.md
@@ -656,6 +656,13 @@ Foreach ($File in $MEDIA_NEW_FILES)
}
}
+```
+
+### Finish up
+
+As a last step, the script removes the working folder of temporary files, and unmounts our language pack and Features on Demand ISOs.
+
+```powershell
#
# Perform final cleanup
#
@@ -670,11 +677,3 @@ Dismount-DiskImage -ImagePath $FOD_ISO_PATH -ErrorAction stop | Out-Null
Write-Output "$(Get-TS): Media refresh completed!"
```
-
-### Finish up
-
-As a last step, the script removes the working folder of temporary files, and unmounts our language pack and Features on Demand ISOs.
-
-```powershell
-TODO
-```
From a59e627cf321c8d417783ef68ab692fe878c3596 Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Mon, 27 Jan 2025 20:51:26 -0500
Subject: [PATCH 24/86] freshness review
---
education/windows/federated-sign-in.md | 2 +-
.../hello-for-business/rdp-sign-in.md | 2 +-
...e-hellman-protocol-over-ikev2-vpn-connections.md | 2 +-
...le-sign-on-sso-over-vpn-and-wi-fi-connections.md | 2 +-
.../network-security/vpn/vpn-authentication.md | 13 +------------
.../vpn/vpn-auto-trigger-profile.md | 13 +------------
.../network-security/vpn/vpn-conditional-access.md | 13 +------------
.../network-security/vpn/vpn-connection-type.md | 12 +-----------
.../network-security/vpn/vpn-guide.md | 2 +-
.../network-security/vpn/vpn-name-resolution.md | 13 +------------
.../vpn/vpn-office-365-optimization.md | 2 +-
.../network-security/vpn/vpn-profile-options.md | 12 +-----------
.../network-security/vpn/vpn-routing.md | 13 +------------
.../network-security/vpn/vpn-security-features.md | 13 +------------
14 files changed, 14 insertions(+), 100 deletions(-)
diff --git a/education/windows/federated-sign-in.md b/education/windows/federated-sign-in.md
index aca908bb45..9a73ef453c 100644
--- a/education/windows/federated-sign-in.md
+++ b/education/windows/federated-sign-in.md
@@ -1,7 +1,7 @@
---
title: Configure federated sign-in for Windows devices
description: Learn how federated sign-in in Windows works and how to configure it.
-ms.date: 06/03/2024
+ms.date: 01/27/2025
ms.topic: how-to
appliesto:
- ✅ Windows 11
diff --git a/windows/security/identity-protection/hello-for-business/rdp-sign-in.md b/windows/security/identity-protection/hello-for-business/rdp-sign-in.md
index bc28fecee5..305932af9b 100644
--- a/windows/security/identity-protection/hello-for-business/rdp-sign-in.md
+++ b/windows/security/identity-protection/hello-for-business/rdp-sign-in.md
@@ -1,7 +1,7 @@
---
title: Remote Desktop sign-in with Windows Hello for Business
description: Learn how to configure Remote Desktop (RDP) sign-in with Windows Hello for Business.
-ms.date: 06/11/2024
+ms.date: 01/27/2025
ms.topic: how-to
---
diff --git a/windows/security/operating-system-security/network-security/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md b/windows/security/operating-system-security/network-security/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md
index c2a7ae57a8..2fc0efca6e 100644
--- a/windows/security/operating-system-security/network-security/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md
+++ b/windows/security/operating-system-security/network-security/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md
@@ -1,7 +1,7 @@
---
title: How to configure cryptographic settings for IKEv2 VPN connections
description: Learn how to update the IKEv2 cryptographic settings of VPN servers and clients by running VPN cmdlets to secure connections.
-ms.date: 05/06/2024
+ms.date: 01/27/2025
ms.topic: how-to
---
diff --git a/windows/security/operating-system-security/network-security/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md b/windows/security/operating-system-security/network-security/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md
index daf7f89f5d..9a4865a98c 100644
--- a/windows/security/operating-system-security/network-security/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md
+++ b/windows/security/operating-system-security/network-security/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md
@@ -1,7 +1,7 @@
---
title: How to use single sign-on (SSO) over VPN and Wi-Fi connections
description: Explains requirements to enable single sign-on (SSO) to on-premises domain resources over WiFi or VPN connections.
-ms.date: 05/06/2024
+ms.date: 01/27/2025
ms.topic: how-to
---
diff --git a/windows/security/operating-system-security/network-security/vpn/vpn-authentication.md b/windows/security/operating-system-security/network-security/vpn/vpn-authentication.md
index 539eeaeda6..26a2c22a06 100644
--- a/windows/security/operating-system-security/network-security/vpn/vpn-authentication.md
+++ b/windows/security/operating-system-security/network-security/vpn/vpn-authentication.md
@@ -1,7 +1,7 @@
---
title: VPN authentication options
description: Learn about the EAP authentication methods that Windows supports in VPNs to provide secure authentication using username/password and certificate-based methods.
-ms.date: 05/06/2024
+ms.date: 01/27/2025
ms.topic: concept-article
---
@@ -80,14 +80,3 @@ The following image shows the field for EAP XML in a Microsoft Intune VPN profil
:::image type="content" source="images/vpn-eap-xml.png" alt-text="Screenshot showing EAP XML configuration in Intune profile.":::
-## Related topics
-
-- [VPN technical guide](vpn-guide.md)
-- [VPN connection types](vpn-connection-type.md)
-- [VPN routing decisions](vpn-routing.md)
-- [VPN and conditional access](vpn-conditional-access.md)
-- [VPN name resolution](vpn-name-resolution.md)
-- [VPN auto-triggered profile options](vpn-auto-trigger-profile.md)
-- [VPN security features](vpn-security-features.md)
-- [VPN profile options](vpn-profile-options.md)
-- [Extensible Authentication Protocol (EAP) for network access](/windows-server/networking/technologies/extensible-authentication-protocol/network-access)
diff --git a/windows/security/operating-system-security/network-security/vpn/vpn-auto-trigger-profile.md b/windows/security/operating-system-security/network-security/vpn/vpn-auto-trigger-profile.md
index 85b51dd4d1..53c870afc0 100644
--- a/windows/security/operating-system-security/network-security/vpn/vpn-auto-trigger-profile.md
+++ b/windows/security/operating-system-security/network-security/vpn/vpn-auto-trigger-profile.md
@@ -1,7 +1,7 @@
---
title: VPN auto-triggered profile options
description: With auto-triggered VPN profile options, Windows can automatically establish a VPN connection based on IT admin-defined rules. Learn about the types of auto-trigger rules that you can create for VPN connections.
-ms.date: 05/06/2024
+ms.date: 01/27/2025
ms.topic: how-to
---
@@ -77,14 +77,3 @@ See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](/windows/clien
The following image shows associating apps to a VPN connection in a VPN Profile configuration policy using Microsoft Intune.
:::image type="content" source="images/vpn-app-trigger.png" alt-text="Creation of VPN profile in Intune: application association options." lightbox="images/vpn-app-trigger.png":::
-
-## Related articles
-
-- [VPN technical guide](vpn-guide.md)
-- [VPN connection types](vpn-connection-type.md)
-- [VPN routing decisions](vpn-routing.md)
-- [VPN authentication options](vpn-authentication.md)
-- [VPN and conditional access](vpn-conditional-access.md)
-- [VPN name resolution](vpn-name-resolution.md)
-- [VPN security features](vpn-security-features.md)
-- [VPN profile options](vpn-profile-options.md)
diff --git a/windows/security/operating-system-security/network-security/vpn/vpn-conditional-access.md b/windows/security/operating-system-security/network-security/vpn/vpn-conditional-access.md
index 8fa4ab6725..e912b38f54 100644
--- a/windows/security/operating-system-security/network-security/vpn/vpn-conditional-access.md
+++ b/windows/security/operating-system-security/network-security/vpn/vpn-conditional-access.md
@@ -1,7 +1,7 @@
---
title: VPN and conditional access
description: Learn how to integrate the VPN client with the Conditional Access platform, and how to create access rules for Microsoft Entra connected apps.
-ms.date: 05/06/2024
+ms.date: 01/27/2025
ms.topic: how-to
---
@@ -92,14 +92,3 @@ See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](/windows/clien
- [Tip of the Day: The Conditional Access Framework and Device Compliance for VPN (Part 2)](/archive/blogs/tip_of_the_day/tip-of-the-day-the-conditional-access-framework-and-device-compliance-for-vpn-part-2)
- [Tip of the Day: The Conditional Access Framework and Device Compliance for VPN (Part 3)](/archive/blogs/tip_of_the_day/tip-of-the-day-the-conditional-access-framework-and-device-compliance-for-vpn-part-3)
- [Tip of the Day: The Conditional Access Framework and Device Compliance for VPN (Part 4)](/archive/blogs/tip_of_the_day/tip-of-the-day-the-conditional-access-framework-and-device-compliance-for-vpn-part-4)
-
-## Related articles
-
-- [VPN technical guide](vpn-guide.md)
-- [VPN connection types](vpn-connection-type.md)
-- [VPN routing decisions](vpn-routing.md)
-- [VPN authentication options](vpn-authentication.md)
-- [VPN name resolution](vpn-name-resolution.md)
-- [VPN auto-triggered profile options](vpn-auto-trigger-profile.md)
-- [VPN security features](vpn-security-features.md)
-- [VPN profile options](vpn-profile-options.md)
diff --git a/windows/security/operating-system-security/network-security/vpn/vpn-connection-type.md b/windows/security/operating-system-security/network-security/vpn/vpn-connection-type.md
index 7199978f6c..0c0b47c65c 100644
--- a/windows/security/operating-system-security/network-security/vpn/vpn-connection-type.md
+++ b/windows/security/operating-system-security/network-security/vpn/vpn-connection-type.md
@@ -1,7 +1,7 @@
---
title: VPN connection types
description: Learn about Windows VPN platform clients and the VPN connection-type features that can be configured.
-ms.date: 05/06/2024
+ms.date: 01/27/2025
ms.topic: concept-article
---
@@ -46,13 +46,3 @@ In Intune, you can also include custom XML for non-Microsoft plug-in profiles:
> [!div class="mx-imgBorder"]
> 
-## Related articles
-
-- [VPN technical guide](vpn-guide.md)
-- [VPN routing decisions](vpn-routing.md)
-- [VPN authentication options](vpn-authentication.md)
-- [VPN and conditional access](vpn-conditional-access.md)
-- [VPN name resolution](vpn-name-resolution.md)
-- [VPN auto-triggered profile options](vpn-auto-trigger-profile.md)
-- [VPN security features](vpn-security-features.md)
-- [VPN profile options](vpn-profile-options.md)
diff --git a/windows/security/operating-system-security/network-security/vpn/vpn-guide.md b/windows/security/operating-system-security/network-security/vpn/vpn-guide.md
index 3233517baa..c1c9ac3826 100644
--- a/windows/security/operating-system-security/network-security/vpn/vpn-guide.md
+++ b/windows/security/operating-system-security/network-security/vpn/vpn-guide.md
@@ -1,7 +1,7 @@
---
title: Windows VPN technical guide
description: Learn how to plan and configure Windows devices for your organization's VPN solution.
-ms.date: 05/06/2024
+ms.date: 01/27/2025
ms.topic: overview
---
diff --git a/windows/security/operating-system-security/network-security/vpn/vpn-name-resolution.md b/windows/security/operating-system-security/network-security/vpn/vpn-name-resolution.md
index 666f60d6c1..36074af74a 100644
--- a/windows/security/operating-system-security/network-security/vpn/vpn-name-resolution.md
+++ b/windows/security/operating-system-security/network-security/vpn/vpn-name-resolution.md
@@ -1,7 +1,7 @@
---
title: VPN name resolution
description: Learn how name resolution works when using a VPN connection.
-ms.date: 05/06/2024
+ms.date: 01/27/2025
ms.topic: concept-article
---
@@ -58,14 +58,3 @@ The fields in **Add or edit DNS rule** in the Intune profile correspond to the X
| **Name** | **VPNv2/*ProfileName*/DomainNameInformationList/*dniRowId*/DomainName** |
| **Servers (comma separated)** | **VPNv2/*ProfileName*/DomainNameInformationList/*dniRowId*/DnsServers** |
| **Proxy server** | **VPNv2/*ProfileName*/DomainNameInformationList/*dniRowId*/WebServers** |
-
-## Related articles
-
-- [VPN technical guide](vpn-guide.md)
-- [VPN connection types](vpn-connection-type.md)
-- [VPN routing decisions](vpn-routing.md)
-- [VPN authentication options](vpn-authentication.md)
-- [VPN and conditional access](vpn-conditional-access.md)
-- [VPN auto-triggered profile options](vpn-auto-trigger-profile.md)
-- [VPN security features](vpn-security-features.md)
-- [VPN profile options](vpn-profile-options.md)
\ No newline at end of file
diff --git a/windows/security/operating-system-security/network-security/vpn/vpn-office-365-optimization.md b/windows/security/operating-system-security/network-security/vpn/vpn-office-365-optimization.md
index aced17dd8e..02b7c5daff 100644
--- a/windows/security/operating-system-security/network-security/vpn/vpn-office-365-optimization.md
+++ b/windows/security/operating-system-security/network-security/vpn/vpn-office-365-optimization.md
@@ -2,7 +2,7 @@
title: Optimize Microsoft 365 traffic for remote workers with the Windows VPN client
description: Learn how to optimize Microsoft 365 traffic for remote workers with the Windows VPN client
ms.topic: how-to
-ms.date: 05/06/2024
+ms.date: 01/27/2025
---
# Optimize Microsoft 365 traffic for remote workers with the Windows VPN client
diff --git a/windows/security/operating-system-security/network-security/vpn/vpn-profile-options.md b/windows/security/operating-system-security/network-security/vpn/vpn-profile-options.md
index 4fdbb86971..43f5802163 100644
--- a/windows/security/operating-system-security/network-security/vpn/vpn-profile-options.md
+++ b/windows/security/operating-system-security/network-security/vpn/vpn-profile-options.md
@@ -1,7 +1,7 @@
---
title: VPN profile options
description: Windows adds Virtual Private Network (VPN) profile options to help manage how users connect. VPNs give users secure remote access to the company network.
-ms.date: 05/06/2024
+ms.date: 01/27/2025
ms.topic: how-to
---
@@ -316,13 +316,3 @@ After you configure the settings that you want using ProfileXML, you can create
- [VPNv2 configuration service provider (CSP) reference](/windows/client-management/mdm/vpnv2-csp)
- [How to Create VPN Profiles in Configuration Manager](/previous-versions/system-center/system-center-2012-R2/dn261200(v=technet.10))
-## Related articles
-
-- [VPN technical guide](vpn-guide.md)
-- [VPN connection types](vpn-connection-type.md)
-- [VPN routing decisions](vpn-routing.md)
-- [VPN authentication options](vpn-authentication.md)
-- [VPN and conditional access](vpn-conditional-access.md)
-- [VPN name resolution](vpn-name-resolution.md)
-- [VPN auto-triggered profile options](vpn-auto-trigger-profile.md)
-- [VPN security features](vpn-security-features.md)
diff --git a/windows/security/operating-system-security/network-security/vpn/vpn-routing.md b/windows/security/operating-system-security/network-security/vpn/vpn-routing.md
index e5f0bc3f68..6bbae9aa58 100644
--- a/windows/security/operating-system-security/network-security/vpn/vpn-routing.md
+++ b/windows/security/operating-system-security/network-security/vpn/vpn-routing.md
@@ -1,5 +1,5 @@
---
-ms.date: 05/06/2024
+ms.date: 01/27/2025
title: VPN routing decisions
description: Learn about approaches that either send all data through a VPN or only selected data. The one you choose impacts capacity planning and security expectations.
ms.topic: concept-article
@@ -43,14 +43,3 @@ When you configure a VPN profile in Microsoft Intune, you can enable split tunne

Once enabled, you can add the routes that should use the VPN connection.
-
-## Related articles
-
-- [VPN technical guide](vpn-guide.md)
-- [VPN connection types](vpn-connection-type.md)
-- [VPN authentication options](vpn-authentication.md)
-- [VPN and conditional access](vpn-conditional-access.md)
-- [VPN name resolution](vpn-name-resolution.md)
-- [VPN auto-triggered profile options](vpn-auto-trigger-profile.md)
-- [VPN security features](vpn-security-features.md)
-- [VPN profile options](vpn-profile-options.md)
\ No newline at end of file
diff --git a/windows/security/operating-system-security/network-security/vpn/vpn-security-features.md b/windows/security/operating-system-security/network-security/vpn/vpn-security-features.md
index 0ca87d7370..2e53eeeae5 100644
--- a/windows/security/operating-system-security/network-security/vpn/vpn-security-features.md
+++ b/windows/security/operating-system-security/network-security/vpn/vpn-security-features.md
@@ -1,7 +1,7 @@
---
title: VPN security features
description: Learn about security features for VPN, including LockDown VPN and traffic filters.
-ms.date: 05/06/2024
+ms.date: 01/27/2025
ms.topic: concept-article
---
@@ -55,14 +55,3 @@ A VPN profile configured with LockDown secures the device to only allow network
> [!CAUTION]
> Be careful when deploying LockDown VPN, as the resultant connection won't be able to send or receive any network traffic without the VPN connection being established.
-
-## Related articles
-
-- [VPN technical guide](vpn-guide.md)
-- [VPN connection types](vpn-connection-type.md)
-- [VPN routing decisions](vpn-routing.md)
-- [VPN authentication options](vpn-authentication.md)
-- [VPN and conditional access](vpn-conditional-access.md)
-- [VPN name resolution](vpn-name-resolution.md)
-- [VPN auto-triggered profile options](vpn-auto-trigger-profile.md)
-- [VPN profile options](vpn-profile-options.md)
From fc28c60c9d565f66f1d6b86170a57b2082374839 Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Mon, 27 Jan 2025 21:04:32 -0500
Subject: [PATCH 25/86] Acrolinx
---
.../network-security/vpn/vpn-conditional-access.md | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/windows/security/operating-system-security/network-security/vpn/vpn-conditional-access.md b/windows/security/operating-system-security/network-security/vpn/vpn-conditional-access.md
index e912b38f54..8b93ff6019 100644
--- a/windows/security/operating-system-security/network-security/vpn/vpn-conditional-access.md
+++ b/windows/security/operating-system-security/network-security/vpn/vpn-conditional-access.md
@@ -19,7 +19,7 @@ Conditional Access Platform components used for Device Compliance include the fo
- [Windows Health Attestation Service](../../system-security/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md) (optional)
- Microsoft Entra Certificate Authority - It's a requirement that the client certificate used for the cloud-based device compliance solution be issued by a Microsoft Entra ID-based Certificate Authority (CA). A Microsoft Entra CA is essentially a mini-CA cloud tenant in Azure. The Microsoft Entra CA can't be configured as part of an on-premises Enterprise CA.
See also [Always On VPN deployment for Windows Server and Windows 10](/windows-server/remote/remote-access/vpn/always-on-vpn/deploy/always-on-vpn-deploy).
-- Microsoft Entra ID-issued short-lived certificates - When a VPN connection attempt is made, the Microsoft Entra Token Broker on the local device communicates with Microsoft Entra ID, which then checks for health based on compliance rules. If compliant, Microsoft Entra ID sends back a short-lived certificate that is used to authenticate the VPN. Note that certificate authentication methods such as EAP-TLS can be used. When the client reconnects and determines that the certificate has expired, the client will again check with Microsoft Entra ID for health validation before a new certificate is issued.
+- Microsoft Entra ID-issued short-lived certificates - When a VPN connection attempt is made, the Microsoft Entra Token Broker on the local device communicates with Microsoft Entra ID, which then checks for health based on compliance rules. If compliant, Microsoft Entra ID sends back a short-lived certificate that is used to authenticate the VPN. Certificate authentication methods such as EAP-TLS can be used. When the client reconnects and determines that the certificate has expired, the client will again check with Microsoft Entra ID for health validation before a new certificate is issued.
- [Microsoft Intune device compliance policies](/mem/intune/protect/device-compliance-get-started): Cloud-based device compliance uses Microsoft Intune Compliance Policies, which are capable of querying the device state and define compliance rules for the following, among other things.
- Antivirus status
- Auto-update status and update compliance
@@ -35,7 +35,7 @@ The following client-side components are also required:
## VPN device compliance
-At this time, the Microsoft Entra certificates issued to users don't contain a CRL Distribution Point (CDP) and aren't suitable for Key Distribution Centers (KDCs) to issue Kerberos tokens. For users to gain access to on-premises resources such as files on a network share, client authentication certificates must be deployed to the Windows profiles of the users, and their VPNv2 profiles must contain the <SSO> section.
+At this time, the Microsoft Entra certificates issued to users don't contain a CRL Distribution Point (CDP) and aren't suitable for Key Distribution Centers (KDCs) to issue Kerberos tokens. For users to gain access to on-premises resources such as files on a network share, client authentication certificates must be deployed to the Windows profiles of the users, and their VPNv2 profiles must contain the section.
Server-side infrastructure requirements to support VPN device compliance include:
@@ -60,8 +60,8 @@ Two client-side configuration service providers are leveraged for VPN device com
- Upon request, forward the Health Attestation Certificate (received from HAS) and related runtime information to the MDM server for verification
> [!NOTE]
-> It's required that certificates used for obtaining Kerberos tickets to be issued from an on-premises CA, and that SSO to be enabled in the user's VPN profile. This will enable the user to access on-premises resources.
-> In the case of AzureAD-only joined devices (not hybrid joined devices), if the user certificate issued by the on-premises CA has the user UPN from AzureAD in Subject and SAN (Subject Alternative Name), the VPN profile must be modified to ensure that the client does not cache the credentials used for VPN authentication. To do this, after deploying the VPN profile to the client, modify the *Rasphone.pbk* on the client by changing the entry **UseRasCredentials** from 1 (default) to 0 (zero).
+> It's required that certificates used for obtaining Kerberos tickets to be issued from an on-premises CA, and that SSO to be enabled in the user's VPN profile. This allows the user to access on-premises resources.
+> In the case of Microsoft Entra joined devices (not hybrid joined devices), if the user certificate issued by the on-premises CA has the user UPN from Microsoft Entra in Subject and SAN (Subject Alternative Name), the VPN profile must be modified to ensure that the client doesn't cache the credentials used for VPN authentication. To do this, after deploying the VPN profile to the client, modify the *Rasphone.pbk* on the client by changing the entry **UseRasCredentials** from 1 (default) to 0 (zero).
## Client connection flow
@@ -71,7 +71,7 @@ The VPN client side connection flow works as follows:
When a VPNv2 Profile is configured with \ \true<\/Enabled> the VPN client uses this connection flow:
-1. The VPN client calls into Windows 10's or Windows 11's Microsoft Entra Token Broker, identifying itself as a VPN client.
+1. The VPN client calls into Windows 10 or Windows 11 Microsoft Entra Token Broker, identifying itself as a VPN client.
1. The Microsoft Entra Token Broker authenticates to Microsoft Entra ID and provides it with information about the device trying to connect. The Microsoft Entra Server checks if the device is in compliance with the policies.
1. If compliant, Microsoft Entra ID requests a short-lived certificate.
1. Microsoft Entra ID pushes down a short-lived certificate to the Certificate Store via the Token Broker. The Token Broker then returns control back over to the VPN client for further connection processing.
From 245f29986b072dce32e6ab40f591d278cf2e72f8 Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Mon, 27 Jan 2025 21:09:08 -0500
Subject: [PATCH 26/86] fix HTML tag
---
.../network-security/vpn/vpn-conditional-access.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/security/operating-system-security/network-security/vpn/vpn-conditional-access.md b/windows/security/operating-system-security/network-security/vpn/vpn-conditional-access.md
index 8b93ff6019..9702c4afee 100644
--- a/windows/security/operating-system-security/network-security/vpn/vpn-conditional-access.md
+++ b/windows/security/operating-system-security/network-security/vpn/vpn-conditional-access.md
@@ -35,7 +35,7 @@ The following client-side components are also required:
## VPN device compliance
-At this time, the Microsoft Entra certificates issued to users don't contain a CRL Distribution Point (CDP) and aren't suitable for Key Distribution Centers (KDCs) to issue Kerberos tokens. For users to gain access to on-premises resources such as files on a network share, client authentication certificates must be deployed to the Windows profiles of the users, and their VPNv2 profiles must contain the section.
+At this time, the Microsoft Entra certificates issued to users don't contain a CRL Distribution Point (CDP) and aren't suitable for Key Distribution Centers (KDCs) to issue Kerberos tokens. For users to gain access to on-premises resources such as files on a network share, client authentication certificates must be deployed to the Windows profiles of the users, and their VPNv2 profiles must contain the `` section.
Server-side infrastructure requirements to support VPN device compliance include:
From b883d6e6c6453ba8f515de5702b741b7d01469cc Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Tue, 28 Jan 2025 08:57:50 -0800
Subject: [PATCH 27/86] cpw2-9694988
---
windows/client-management/manage-windows-copilot.md | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/windows/client-management/manage-windows-copilot.md b/windows/client-management/manage-windows-copilot.md
index 2af6627e8d..655fdb09e4 100644
--- a/windows/client-management/manage-windows-copilot.md
+++ b/windows/client-management/manage-windows-copilot.md
@@ -3,7 +3,7 @@ title: Updated Windows and Microsoft 365 Copilot Chat experience
description: Learn about changes to the Copilot in Windows experience for commercial environments and how to configure it for your organization.
ms.topic: overview
ms.subservice: windows-copilot
-ms.date: 01/22/2025
+ms.date: 01/28/2025
ms.author: mstewart
author: mestew
ms.collection:
@@ -80,7 +80,7 @@ The following policy to manage Copilot in Windows (preview) will be removed in t
You can remove or uninstall the Copilot app from your device by using one of the following methods:
-1. Enterprise users can uninstall the Copilot app by going to **Settings** > **Apps** >**Installed Apps**. Select the three dots appearing on the right side of the app and select **Uninstall** from the dropdown list.
+1. Enterprise users can uninstall the [Copilot app](https://apps.microsoft.com/detail/9NHT9RB2F4HD), which is a consumer experience, by going to **Settings** > **Apps** >**Installed Apps**. Select the three dots appearing on the right side of the app and select **Uninstall** from the dropdown list.
1. If you are an IT administrator, you can prevent installation of the app or remove the Copilot app using one of the following methods:
1. Prevent installation of the Copilot app:
From 866d47341e471cab8d31f0352ed10c65238cec54 Mon Sep 17 00:00:00 2001
From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com>
Date: Tue, 28 Jan 2025 10:05:32 -0700
Subject: [PATCH 28/86] Update applications-that-can-bypass-appcontrol.md
---
.../design/applications-that-can-bypass-appcontrol.md | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/windows/security/application-security/application-control/app-control-for-business/design/applications-that-can-bypass-appcontrol.md b/windows/security/application-security/application-control/app-control-for-business/design/applications-that-can-bypass-appcontrol.md
index 23d40c8440..f25bd9c11d 100644
--- a/windows/security/application-security/application-control/app-control-for-business/design/applications-that-can-bypass-appcontrol.md
+++ b/windows/security/application-security/application-control/app-control-for-business/design/applications-that-can-bypass-appcontrol.md
@@ -49,7 +49,7 @@ Unless your use scenarios explicitly require them, Microsoft recommends that you
- texttransform.exe
- visualuiaverifynative.exe
- system.management.automation.dll
-- webclnt.dll/davsvc.dll
+- webclnt.dll/davsvc.dll3
- wfc.exe
- windbg.exe
- wmic.exe
@@ -62,6 +62,8 @@ Unless your use scenarios explicitly require them, Microsoft recommends that you
2 If you're using your reference system in a development context and use msbuild.exe to build managed applications, we recommend that you allow msbuild.exe in your code integrity policies. Otherwise, we recommend that you block msbuild.exe.
+3 If you block WebDAV DLL's, we recommend that you also disable the **WebClient** service using a group policy or MDM policies.
+
* Microsoft recognizes the efforts of people in the security community who help us protect customers through responsible vulnerability disclosure, and extends thanks to the following people:
From bc953482d3337b2af5b0c26774077e6731a000f8 Mon Sep 17 00:00:00 2001
From: Padma Jayaraman
Date: Tue, 28 Jan 2025 23:18:34 +0530
Subject: [PATCH 29/86] Fix typo in WebDAV DLLs recommendation.
---
.../design/applications-that-can-bypass-appcontrol.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/security/application-security/application-control/app-control-for-business/design/applications-that-can-bypass-appcontrol.md b/windows/security/application-security/application-control/app-control-for-business/design/applications-that-can-bypass-appcontrol.md
index f25bd9c11d..f2ebb636f5 100644
--- a/windows/security/application-security/application-control/app-control-for-business/design/applications-that-can-bypass-appcontrol.md
+++ b/windows/security/application-security/application-control/app-control-for-business/design/applications-that-can-bypass-appcontrol.md
@@ -62,7 +62,7 @@ Unless your use scenarios explicitly require them, Microsoft recommends that you
2 If you're using your reference system in a development context and use msbuild.exe to build managed applications, we recommend that you allow msbuild.exe in your code integrity policies. Otherwise, we recommend that you block msbuild.exe.
-3 If you block WebDAV DLL's, we recommend that you also disable the **WebClient** service using a group policy or MDM policies.
+3 If you block WebDAV DLLs, we recommend that you also disable the **WebClient** service using a group policy or MDM policies.
* Microsoft recognizes the efforts of people in the security community who help us protect customers through responsible vulnerability disclosure, and extends thanks to the following people:
From 7b0694f4bc50372c74a9470a32bd0fcde3754149 Mon Sep 17 00:00:00 2001
From: David Strome <21028455+dstrome@users.noreply.github.com>
Date: Tue, 28 Jan 2025 14:10:33 -0800
Subject: [PATCH 30/86] Add BuildValidation workflow
---
.github/workflows/BuildValidation.yml | 21 +++++++++++++++++++++
1 file changed, 21 insertions(+)
create mode 100644 .github/workflows/BuildValidation.yml
diff --git a/.github/workflows/BuildValidation.yml b/.github/workflows/BuildValidation.yml
new file mode 100644
index 0000000000..e57844b453
--- /dev/null
+++ b/.github/workflows/BuildValidation.yml
@@ -0,0 +1,21 @@
+name: PR has no warnings or errors
+
+permissions:
+ pull-requests: write
+ statuses: write
+
+on:
+ issue_comment:
+ types: [created]
+
+jobs:
+
+ build-status:
+ uses: MicrosoftDocs/microsoft-365-docs/.github/workflows/Shared-BuildValidation.yml@workflows-prod
+ with:
+ PayloadJson: ${{ toJSON(github) }}
+ secrets:
+ AccessToken: ${{ secrets.GITHUB_TOKEN }}
+
+
+
From f01b4a9fd585a2bd5b1a813b4cbc5fbf7473682e Mon Sep 17 00:00:00 2001
From: David Callaghan
Date: Wed, 29 Jan 2025 11:49:50 -0800
Subject: [PATCH 31/86] Update windows-autopatch-hotpatch-updates.md
Removing ** asterisks and clarifying the registry key value and path to avoid customers using the wrong information.
---
.../manage/windows-autopatch-hotpatch-updates.md | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/windows/deployment/windows-autopatch/manage/windows-autopatch-hotpatch-updates.md b/windows/deployment/windows-autopatch/manage/windows-autopatch-hotpatch-updates.md
index 026f05bd13..d92f402704 100644
--- a/windows/deployment/windows-autopatch/manage/windows-autopatch-hotpatch-updates.md
+++ b/windows/deployment/windows-autopatch/manage/windows-autopatch-hotpatch-updates.md
@@ -40,9 +40,9 @@ VBS must be turned on for a device to be offered Hotpatch updates. For informati
### Arm 64 devices must disable compiled hybrid PE usage (CHPE) (Arm 64 CPU Only)
-This requirement only applies to Arm 64 CPU devices when using Hotpatch updates. Hotpatch updates aren't compatible with servicing CHPE OS binaries located in the `%SystemRoot%\SyChpe32` folder. To ensure all the Hotpatch updates are applied, you must set the CHPE disable flag and restart the device to disable CHPE usage. You only need to set this flag one time. The registry setting remains applied through updates. To disable CHPE, set the following registry key:
-Path: `**HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management**`
-Key value: `**HotPatchRestrictions=1**`
+This requirement only applies to Arm 64 CPU devices when using Hotpatch updates. Hotpatch updates aren't compatible with servicing CHPE OS binaries located in the `%SystemRoot%\SyChpe32` folder. To ensure all the Hotpatch updates are applied, you must set the CHPE disable flag and restart the device to disable CHPE usage. You only need to set this flag one time. The registry setting remains applied through updates. To disable CHPE, create and/or set the following DWORD registry key:
+Path: `HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management`
+DWORD key value: HotPatchRestrictions=1
> [!IMPORTANT]
> This setting is required because it forces the operating system to use the emulation x86-only binaries instead of CHPE binaries on Arm 64 devices. CHPE binaries include native Arm 64 code to improve performance, excluding the CHPE binaries might affect performance or compatibility. Be sure to test application compatibility and performance before rolling out Hotpatch updates widely on Arm 64 CPU based devices.
From 24c2e18504b1afaf66778ece499504cd45eb3537 Mon Sep 17 00:00:00 2001
From: Frank Rojas <45807133+frankroj@users.noreply.github.com>
Date: Wed, 29 Jan 2025 15:35:05 -0500
Subject: [PATCH 32/86] Update review date on reviewed articles
---
...rted-with-the-user-state-migration-tool.md | 2 +-
.../usmt/migrate-application-settings.md | 2 +-
.../usmt/migration-store-types-overview.md | 2 +-
.../usmt/offline-migration-reference.md | 10 ++--
.../usmt/understanding-migration-xml-files.md | 2 +-
.../deployment/usmt/usmt-best-practices.md | 2 +-
.../usmt/usmt-choose-migration-store-type.md | 2 +-
.../usmt/usmt-command-line-syntax.md | 2 +-
.../usmt/usmt-common-migration-scenarios.md | 2 +-
.../deployment/usmt/usmt-configxml-file.md | 4 +-
.../usmt/usmt-conflicts-and-precedence.md | 16 +++----
.../usmt/usmt-custom-xml-examples.md | 10 ++--
.../usmt/usmt-customize-xml-files.md | 2 +-
.../usmt/usmt-determine-what-to-migrate.md | 2 +-
.../usmt-estimate-migration-store-size.md | 2 +-
.../usmt/usmt-exclude-files-and-settings.md | 2 +-
...files-from-a-compressed-migration-store.md | 2 +-
windows/deployment/usmt/usmt-faq.yml | 48 +++++++++----------
.../usmt/usmt-general-conventions.md | 18 +++----
.../usmt/usmt-hard-link-migration-store.md | 2 +-
windows/deployment/usmt/usmt-how-it-works.md | 4 +-
windows/deployment/usmt/usmt-how-to.md | 2 +-
.../usmt-identify-application-settings.md | 2 +-
...t-identify-file-types-files-and-folders.md | 2 +-
...usmt-identify-operating-system-settings.md | 2 +-
.../deployment/usmt/usmt-identify-users.md | 2 +-
.../usmt/usmt-include-files-and-settings.md | 14 +++---
.../deployment/usmt/usmt-loadstate-syntax.md | 2 +-
windows/deployment/usmt/usmt-log-files.md | 2 +-
...usmt-migrate-efs-files-and-certificates.md | 2 +-
.../usmt/usmt-migrate-user-accounts.md | 2 +-
.../usmt/usmt-migration-store-encryption.md | 2 +-
windows/deployment/usmt/usmt-overview.md | 2 +-
.../usmt/usmt-plan-your-migration.md | 2 +-
.../usmt-recognized-environment-variables.md | 2 +-
windows/deployment/usmt/usmt-reference.md | 2 +-
windows/deployment/usmt/usmt-requirements.md | 2 +-
.../usmt/usmt-reroute-files-and-settings.md | 8 ++--
windows/deployment/usmt/usmt-resources.md | 4 +-
.../deployment/usmt/usmt-scanstate-syntax.md | 2 +-
.../usmt/usmt-technical-reference.md | 2 +-
.../usmt/usmt-test-your-migration.md | 2 +-
windows/deployment/usmt/usmt-topics.md | 2 +-
.../deployment/usmt/usmt-troubleshooting.md | 2 +-
windows/deployment/usmt/usmt-utilities.md | 2 +-
.../usmt/usmt-what-does-usmt-migrate.md | 2 +-
.../usmt/usmt-xml-elements-library.md | 44 ++++++++---------
windows/deployment/usmt/usmt-xml-reference.md | 2 +-
...ndition-of-a-compressed-migration-store.md | 2 +-
.../deployment/usmt/xml-file-requirements.md | 2 +-
50 files changed, 129 insertions(+), 129 deletions(-)
diff --git a/windows/deployment/usmt/getting-started-with-the-user-state-migration-tool.md b/windows/deployment/usmt/getting-started-with-the-user-state-migration-tool.md
index 9e1d97ccac..3a2a091e06 100644
--- a/windows/deployment/usmt/getting-started-with-the-user-state-migration-tool.md
+++ b/windows/deployment/usmt/getting-started-with-the-user-state-migration-tool.md
@@ -8,7 +8,7 @@ ms.service: windows-client
author: frankroj
ms.topic: conceptual
ms.subservice: itpro-deploy
-ms.date: 08/30/2024
+ms.date: 01/29/2025
appliesto:
- ✅ Windows 11
- ✅ Windows 10
diff --git a/windows/deployment/usmt/migrate-application-settings.md b/windows/deployment/usmt/migrate-application-settings.md
index d189141607..563fffa13b 100644
--- a/windows/deployment/usmt/migrate-application-settings.md
+++ b/windows/deployment/usmt/migrate-application-settings.md
@@ -6,7 +6,7 @@ manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
-ms.date: 08/30/2024
+ms.date: 01/29/2025
ms.topic: conceptual
ms.subservice: itpro-deploy
appliesto:
diff --git a/windows/deployment/usmt/migration-store-types-overview.md b/windows/deployment/usmt/migration-store-types-overview.md
index f0fdf74531..e69fa2a0eb 100644
--- a/windows/deployment/usmt/migration-store-types-overview.md
+++ b/windows/deployment/usmt/migration-store-types-overview.md
@@ -6,7 +6,7 @@ manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
-ms.date: 01/09/2024
+ms.date: 01/29/2025
ms.topic: conceptual
ms.subservice: itpro-deploy
appliesto:
diff --git a/windows/deployment/usmt/offline-migration-reference.md b/windows/deployment/usmt/offline-migration-reference.md
index 8e72361a5d..631c7b6aa6 100644
--- a/windows/deployment/usmt/offline-migration-reference.md
+++ b/windows/deployment/usmt/offline-migration-reference.md
@@ -6,7 +6,7 @@ manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
-ms.date: 01/09/2024
+ms.date: 01/29/2025
ms.topic: conceptual
ms.subservice: itpro-deploy
appliesto:
@@ -50,7 +50,7 @@ For exceptions to what can be migrated offline, see [What Does USMT Migrate?](us
## What offline environments are supported?
-All currently supported
+All currently supported
The following table defines the supported combination of online and offline operating systems in USMT.
@@ -183,9 +183,9 @@ The following XML example illustrates some of the elements discussed earlier in
```xml
- C:\Windows
- D:\Windows
- E:\
+ C:\Windows
+ D:\Windows
+ E:\
1
diff --git a/windows/deployment/usmt/understanding-migration-xml-files.md b/windows/deployment/usmt/understanding-migration-xml-files.md
index 3adb68387b..2994c4a929 100644
--- a/windows/deployment/usmt/understanding-migration-xml-files.md
+++ b/windows/deployment/usmt/understanding-migration-xml-files.md
@@ -6,7 +6,7 @@ manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
-ms.date: 01/09/2024
+ms.date: 01/29/2025
ms.topic: conceptual
ms.subservice: itpro-deploy
appliesto:
diff --git a/windows/deployment/usmt/usmt-best-practices.md b/windows/deployment/usmt/usmt-best-practices.md
index 4ebf6ff55f..fe77583153 100644
--- a/windows/deployment/usmt/usmt-best-practices.md
+++ b/windows/deployment/usmt/usmt-best-practices.md
@@ -6,7 +6,7 @@ manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
-ms.date: 01/09/2024
+ms.date: 01/29/2025
ms.topic: conceptual
ms.subservice: itpro-deploy
appliesto:
diff --git a/windows/deployment/usmt/usmt-choose-migration-store-type.md b/windows/deployment/usmt/usmt-choose-migration-store-type.md
index 1847cce5d9..e8a0d69a2f 100644
--- a/windows/deployment/usmt/usmt-choose-migration-store-type.md
+++ b/windows/deployment/usmt/usmt-choose-migration-store-type.md
@@ -6,7 +6,7 @@ manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
-ms.date: 01/09/2024
+ms.date: 01/29/2025
ms.topic: conceptual
ms.subservice: itpro-deploy
appliesto:
diff --git a/windows/deployment/usmt/usmt-command-line-syntax.md b/windows/deployment/usmt/usmt-command-line-syntax.md
index 4844937b52..71da51bdda 100644
--- a/windows/deployment/usmt/usmt-command-line-syntax.md
+++ b/windows/deployment/usmt/usmt-command-line-syntax.md
@@ -6,7 +6,7 @@ manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
-ms.date: 01/09/2024
+ms.date: 01/29/2025
ms.topic: conceptual
ms.subservice: itpro-deploy
appliesto:
diff --git a/windows/deployment/usmt/usmt-common-migration-scenarios.md b/windows/deployment/usmt/usmt-common-migration-scenarios.md
index 1685667185..d618b669c3 100644
--- a/windows/deployment/usmt/usmt-common-migration-scenarios.md
+++ b/windows/deployment/usmt/usmt-common-migration-scenarios.md
@@ -6,7 +6,7 @@ manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
-ms.date: 01/09/2024
+ms.date: 01/29/2025
ms.topic: conceptual
ms.subservice: itpro-deploy
appliesto:
diff --git a/windows/deployment/usmt/usmt-configxml-file.md b/windows/deployment/usmt/usmt-configxml-file.md
index c0e4682965..f77777e41f 100644
--- a/windows/deployment/usmt/usmt-configxml-file.md
+++ b/windows/deployment/usmt/usmt-configxml-file.md
@@ -6,7 +6,7 @@ manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
-ms.date: 01/09/2024
+ms.date: 01/29/2025
ms.topic: conceptual
ms.subservice: itpro-deploy
appliesto:
@@ -496,7 +496,7 @@ The following sample `Config.xml` file contains detailed examples about items th
-
+
-->
diff --git a/windows/deployment/usmt/usmt-conflicts-and-precedence.md b/windows/deployment/usmt/usmt-conflicts-and-precedence.md
index f9874a4d2f..c2a0454e4b 100644
--- a/windows/deployment/usmt/usmt-conflicts-and-precedence.md
+++ b/windows/deployment/usmt/usmt-conflicts-and-precedence.md
@@ -6,7 +6,7 @@ manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
-ms.date: 01/09/2024
+ms.date: 01/29/2025
ms.topic: conceptual
ms.subservice: itpro-deploy
appliesto:
@@ -79,7 +79,7 @@ Specifying `migrate="no"` in the `Config.xml` file is the same as deleting the c
%CSIDL_PERSONAL%\* [*.doc]
-
+
```
### How does USMT process each component in an .xml file with multiple components?
@@ -116,7 +116,7 @@ In the following example, mp3 files aren't excluded from the migration. The mp3
C:\* [*.mp3]
-
+
```
### \ and \ rules precedence examples
@@ -185,11 +185,11 @@ The destination computer contains the following files:
A custom **.xml** file contains the following code:
```xml
-
-
- c:\data\* [*]
-
-
+
+
+ c:\data\* [*]
+
+
```
For this example, the following information describes the resulting behavior if the code is added to the custom **.xml** file.
diff --git a/windows/deployment/usmt/usmt-custom-xml-examples.md b/windows/deployment/usmt/usmt-custom-xml-examples.md
index 130f3031c8..c398822c63 100644
--- a/windows/deployment/usmt/usmt-custom-xml-examples.md
+++ b/windows/deployment/usmt/usmt-custom-xml-examples.md
@@ -8,7 +8,7 @@ ms.service: windows-client
author: frankroj
ms.topic: conceptual
ms.subservice: itpro-deploy
-ms.date: 01/09/2024
+ms.date: 01/29/2025
appliesto:
- ✅ Windows 11
- ✅ Windows 10
@@ -120,7 +120,7 @@ The following sample is a custom **.xml** file named `CustomFile.xml` that migra
My Video
-
+
MigXmlHelper.DoesObjectExist("File","%CSIDL_MYVIDEO%")
@@ -251,8 +251,8 @@ The behavior for this custom **.xml** file is described within the `
-
-
+
+
@@ -264,7 +264,7 @@ The behavior for this custom **.xml** file is described within the `
-
+
C:\*\Presentations\* [*]
C:\Presentations\* [*]
diff --git a/windows/deployment/usmt/usmt-customize-xml-files.md b/windows/deployment/usmt/usmt-customize-xml-files.md
index 8eefa733d4..00a902de28 100644
--- a/windows/deployment/usmt/usmt-customize-xml-files.md
+++ b/windows/deployment/usmt/usmt-customize-xml-files.md
@@ -6,7 +6,7 @@ manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
-ms.date: 01/09/2024
+ms.date: 01/29/2025
ms.topic: conceptual
ms.subservice: itpro-deploy
appliesto:
diff --git a/windows/deployment/usmt/usmt-determine-what-to-migrate.md b/windows/deployment/usmt/usmt-determine-what-to-migrate.md
index bad57314e9..098c1a8a45 100644
--- a/windows/deployment/usmt/usmt-determine-what-to-migrate.md
+++ b/windows/deployment/usmt/usmt-determine-what-to-migrate.md
@@ -6,7 +6,7 @@ manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
-ms.date: 01/09/2024
+ms.date: 01/29/2025
ms.topic: conceptual
ms.subservice: itpro-deploy
appliesto:
diff --git a/windows/deployment/usmt/usmt-estimate-migration-store-size.md b/windows/deployment/usmt/usmt-estimate-migration-store-size.md
index 014e48a76e..ae5b4e142e 100644
--- a/windows/deployment/usmt/usmt-estimate-migration-store-size.md
+++ b/windows/deployment/usmt/usmt-estimate-migration-store-size.md
@@ -6,7 +6,7 @@ manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
-ms.date: 01/09/2024
+ms.date: 01/29/2025
ms.topic: conceptual
ms.subservice: itpro-deploy
appliesto:
diff --git a/windows/deployment/usmt/usmt-exclude-files-and-settings.md b/windows/deployment/usmt/usmt-exclude-files-and-settings.md
index 354badb01a..72388d511e 100644
--- a/windows/deployment/usmt/usmt-exclude-files-and-settings.md
+++ b/windows/deployment/usmt/usmt-exclude-files-and-settings.md
@@ -6,7 +6,7 @@ manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
-ms.date: 01/09/2024
+ms.date: 01/29/2025
ms.topic: conceptual
ms.subservice: itpro-deploy
appliesto:
diff --git a/windows/deployment/usmt/usmt-extract-files-from-a-compressed-migration-store.md b/windows/deployment/usmt/usmt-extract-files-from-a-compressed-migration-store.md
index 59234776e5..9fefd6f0b4 100644
--- a/windows/deployment/usmt/usmt-extract-files-from-a-compressed-migration-store.md
+++ b/windows/deployment/usmt/usmt-extract-files-from-a-compressed-migration-store.md
@@ -6,7 +6,7 @@ manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
-ms.date: 01/09/2024
+ms.date: 01/29/2025
ms.topic: conceptual
ms.subservice: itpro-deploy
appliesto:
diff --git a/windows/deployment/usmt/usmt-faq.yml b/windows/deployment/usmt/usmt-faq.yml
index 666888f9d3..fb9a10a99e 100644
--- a/windows/deployment/usmt/usmt-faq.yml
+++ b/windows/deployment/usmt/usmt-faq.yml
@@ -11,12 +11,12 @@ metadata:
ms.mktglfcycl: deploy
ms.sitesec: library
audience: itpro
- ms.date: 01/09/2024
+ ms.date: 01/29/2025
ms.topic: faq
title: Frequently Asked Questions
summary: |
**Applies to:**
-
+
- Windows 11
- Windows 10
@@ -30,13 +30,13 @@ sections:
How much space is needed on the destination computer?
answer: |
The destination computer needs enough available space for the following items:
-
+
- Operating system
-
+
- Applications
-
+
- Uncompressed store
-
+
- question: |
Can the files and settings be stored directly on the destination computer or is a server needed?
answer: |
@@ -47,13 +47,13 @@ sections:
- Directly on the destination computer.
To store it directly on the destination computer:
-
+
1. Create and share the directory `C:\store` on the destination computer.
-
+
1. Run the **ScanState** tool on the source computer and save the files and settings to `\\\store`
-
+
1. Run the **LoadState** tool on the destination computer and specify `C:\store` as the store location.
-
+
- question: |
Can data be migrated between operating systems with different languages?
answer: |
@@ -80,7 +80,7 @@ sections:
How can a folder or a certain type of file be excluded from the migration?
answer: |
The **\** element can be used to globally exclude data from the migration. For example, this element can be used to exclude all MP3 files on the computer or to exclude all files from `C:\UserData`. This element excludes objects regardless of any other **\** rules that are in the **.xml** files. For an example, see **\** in the [Exclude files and settings](usmt-exclude-files-and-settings.md) article. For the syntax of this element, see [XML elements library](usmt-xml-elements-library.md).
-
+
- question: |
What happens to files that were located on a drive that don't exist on the destination computer?
answer: |
@@ -91,22 +91,22 @@ sections:
- C:\\ is the system drive on the destination computer.
the file is migrated to `C:\data\File.pst`. This behavior holds true even when **\** rules attempt to move data to a drive that doesn't exist on the destination computer.
-
+
- name: USMT .xml Files
questions:
- question: |
Where are there examples of USMT **.xml** files?
answer: |
The following articles include examples of USMT **.xml** files:
-
+
- [Exclude files and settings](usmt-exclude-files-and-settings.md)
-
+
- [Reroute files and settings](usmt-reroute-files-and-settings.md)
-
+
- [Include files and settings](usmt-include-files-and-settings.md)
-
+
- [Custom XML examples](usmt-custom-xml-examples.md)
-
+
- question: |
Can custom **.xml** files that were written for USMT 5.0 be used?
answer: |
@@ -121,9 +121,9 @@ sections:
Why must the **.xml** files be included with both the `ScanState.exe` and `LoadState.exe` commands?
answer: |
The **.xml** files aren't copied to the store as in previous versions of USMT. Because the **ScanState** and **LoadState** tools need the **.xml** files to control the migration, the same set of **.xml** files must be specified for the `ScanState.exe` and `LoadState.exe` commands. If a particular set of mig\*.xml files were used in the **ScanState** tool, either called through the `/auto` option, or individually through the `/i` option, then the same option should be used to call the exact same mig\*.xml files in the **LoadState** tool. However, the `Config.xml` file doesn't need to be specified, unless files and settings that were migrated to the store need to be excluded. For example, the **Documents** folder might be migrated to the store, but not to the destination computer. To do this type of migration, modify the `Config.xml` file and specify the updated file with the `LoadState.exe` command. **LoadState** migrates only the desired files and settings.
-
+
If an **.xml** file is excluded from the `LoadState.exe` command, then all of the data in the store that was migrated with the missing **.xml** files are migrated. However, the migration rules that were specified for the `ScanState.exe` command don't apply. For example, if a `MigApp.xml` file that has a rerouting rule such as `MigsysHelperFunction.RelativeMove("c:\data", "%CSIDL_PERSONAL%")` is excluded, USMT doesn't reroute the files. Instead, it migrates them to `C:\data`.
-
+
- question: |
Which files can be modified and specified on the command line?
answer: |
@@ -133,20 +133,20 @@ sections:
What happens if the **.xml** files aren't specified on the command line?
answer: |
- **ScanState**
-
+
If no files are specified with the `ScanState.exe` command, all user accounts and default operating system components are migrated.
-
+
- **LoadState**
-
+
If no files are specified with the `LoadState.exe` command, all data that is in the store is migrated. However, any target-specific migration rules that were specified in **.xml** files with the `ScanState.exe` command doesn't apply. For example, if a `MigApp.xml` file that has a rerouting rule such as `MigsysHelperFunction.RelativeMove("c:\data", "%CSIDL_PERSONAL%")` is excluded, USMT doesn't reroute the files. Instead, it migrates them to `C:\data`.
-
+
- name: Conflicts and Precedence
questions:
- question: |
What happens when there are conflicting XML rules or conflicting objects on the destination computer?
answer: |
For more information, see [Conflicts and precedence](usmt-conflicts-and-precedence.md).
-
+
additionalContent: |
diff --git a/windows/deployment/usmt/usmt-general-conventions.md b/windows/deployment/usmt/usmt-general-conventions.md
index 38b66a02b6..950371b73e 100644
--- a/windows/deployment/usmt/usmt-general-conventions.md
+++ b/windows/deployment/usmt/usmt-general-conventions.md
@@ -6,7 +6,7 @@ manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
-ms.date: 01/09/2024
+ms.date: 01/29/2025
ms.topic: conceptual
ms.subservice: itpro-deploy
appliesto:
@@ -73,21 +73,21 @@ The XML helper functions in the [XML elements library](usmt-xml-elements-library
The encoded location is composed of the node part, optionally followed by the leaf enclosed in square brackets. This format makes a clear distinction between nodes and leaves.
For example, specify the file
-
+
`C:\Windows\Notepad.exe`
-
+
as
-
+
**c:\\Windows\[Notepad.exe\]**
-
+
Similarly, specify the directory
-
+
`C:\Windows\System32`
-
+
as
-
+
**c:\\Windows\\System32**
-
+
Note the absence of the **\[\]** characters in second example.
The registry is represented in a similar way. The default value of a registry key is represented as an empty **\[\]** construct. For example, the default value for the `HKLM\SOFTWARE\MyKey` registry key is **HKLM\\SOFTWARE\\MyKey\[\]**.
diff --git a/windows/deployment/usmt/usmt-hard-link-migration-store.md b/windows/deployment/usmt/usmt-hard-link-migration-store.md
index d2cae89bc7..7c21f7e783 100644
--- a/windows/deployment/usmt/usmt-hard-link-migration-store.md
+++ b/windows/deployment/usmt/usmt-hard-link-migration-store.md
@@ -6,7 +6,7 @@ manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
-ms.date: 01/09/2024
+ms.date: 01/29/2025
ms.topic: conceptual
ms.subservice: itpro-deploy
appliesto:
diff --git a/windows/deployment/usmt/usmt-how-it-works.md b/windows/deployment/usmt/usmt-how-it-works.md
index 591b1d3804..0da69dfec4 100644
--- a/windows/deployment/usmt/usmt-how-it-works.md
+++ b/windows/deployment/usmt/usmt-how-it-works.md
@@ -8,7 +8,7 @@ ms.service: windows-client
author: frankroj
ms.topic: conceptual
ms.subservice: itpro-deploy
-ms.date: 01/09/2024
+ms.date: 01/29/2025
appliesto:
- ✅ Windows 11
- ✅ Windows 10
@@ -33,7 +33,7 @@ When the **ScanState** tool runs on the source computer, it goes through the fol
There are three types of components:
- Components that migrate the operating system settings.
-
+
- Components that migrate application settings.
- Components that migrate users' files.
diff --git a/windows/deployment/usmt/usmt-how-to.md b/windows/deployment/usmt/usmt-how-to.md
index c3589124d1..72231c5f35 100644
--- a/windows/deployment/usmt/usmt-how-to.md
+++ b/windows/deployment/usmt/usmt-how-to.md
@@ -6,7 +6,7 @@ manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
-ms.date: 01/09/2024
+ms.date: 01/29/2025
ms.topic: conceptual
ms.subservice: itpro-deploy
appliesto:
diff --git a/windows/deployment/usmt/usmt-identify-application-settings.md b/windows/deployment/usmt/usmt-identify-application-settings.md
index feca874008..41d2a4f881 100644
--- a/windows/deployment/usmt/usmt-identify-application-settings.md
+++ b/windows/deployment/usmt/usmt-identify-application-settings.md
@@ -6,7 +6,7 @@ manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
-ms.date: 01/09/2024
+ms.date: 01/29/2025
ms.topic: conceptual
ms.subservice: itpro-deploy
appliesto:
diff --git a/windows/deployment/usmt/usmt-identify-file-types-files-and-folders.md b/windows/deployment/usmt/usmt-identify-file-types-files-and-folders.md
index e5b15c352d..e46ff9f218 100644
--- a/windows/deployment/usmt/usmt-identify-file-types-files-and-folders.md
+++ b/windows/deployment/usmt/usmt-identify-file-types-files-and-folders.md
@@ -6,7 +6,7 @@ manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
-ms.date: 01/09/2024
+ms.date: 01/29/2025
ms.topic: conceptual
ms.subservice: itpro-deploy
appliesto:
diff --git a/windows/deployment/usmt/usmt-identify-operating-system-settings.md b/windows/deployment/usmt/usmt-identify-operating-system-settings.md
index cedbe8d1f9..941df2cced 100644
--- a/windows/deployment/usmt/usmt-identify-operating-system-settings.md
+++ b/windows/deployment/usmt/usmt-identify-operating-system-settings.md
@@ -6,7 +6,7 @@ manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
-ms.date: 01/09/2024
+ms.date: 01/29/2025
ms.topic: conceptual
ms.subservice: itpro-deploy
appliesto:
diff --git a/windows/deployment/usmt/usmt-identify-users.md b/windows/deployment/usmt/usmt-identify-users.md
index 736881d3b3..314590b2b7 100644
--- a/windows/deployment/usmt/usmt-identify-users.md
+++ b/windows/deployment/usmt/usmt-identify-users.md
@@ -9,7 +9,7 @@ author: frankroj
ms.topic: conceptual
ms.localizationpriority: medium
ms.subservice: itpro-deploy
-ms.date: 01/09/2024
+ms.date: 01/29/2025
appliesto:
- ✅ Windows 11
- ✅ Windows 10
diff --git a/windows/deployment/usmt/usmt-include-files-and-settings.md b/windows/deployment/usmt/usmt-include-files-and-settings.md
index f4d79a27f2..6ff87626e6 100644
--- a/windows/deployment/usmt/usmt-include-files-and-settings.md
+++ b/windows/deployment/usmt/usmt-include-files-and-settings.md
@@ -6,7 +6,7 @@ manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
-ms.date: 01/09/2024
+ms.date: 01/29/2025
ms.topic: conceptual
ms.subservice: itpro-deploy
appliesto:
@@ -25,12 +25,12 @@ The following **.xml** file migrates a single registry key.
```xml
- Component to migrate only registry value string
+ Component to migrate only registry value string
- HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache [Persistent]
+ HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache [Persistent]
@@ -95,8 +95,8 @@ The following **.xml** file migrates all files and subfolders of the `Engineerin
-
-
+
+
@@ -114,7 +114,7 @@ The following **.xml** file migrates all files and subfolders of the `Engineerin
-
+
C:\*\EngineeringDrafts\* [*]
C:\EngineeringDrafts\* [*]
@@ -149,7 +149,7 @@ The following **.xml** file migrates `.mp3` files located in the specified drive
-
+
```
## Migrate a specific file
diff --git a/windows/deployment/usmt/usmt-loadstate-syntax.md b/windows/deployment/usmt/usmt-loadstate-syntax.md
index a4bf1f2eeb..30667f7873 100644
--- a/windows/deployment/usmt/usmt-loadstate-syntax.md
+++ b/windows/deployment/usmt/usmt-loadstate-syntax.md
@@ -6,7 +6,7 @@ manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
-ms.date: 04/30/2024
+ms.date: 01/29/2025
ms.topic: conceptual
ms.subservice: itpro-deploy
appliesto:
diff --git a/windows/deployment/usmt/usmt-log-files.md b/windows/deployment/usmt/usmt-log-files.md
index 70f159b544..27e897b01d 100644
--- a/windows/deployment/usmt/usmt-log-files.md
+++ b/windows/deployment/usmt/usmt-log-files.md
@@ -6,7 +6,7 @@ manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
-ms.date: 01/09/2024
+ms.date: 01/29/2025
ms.topic: conceptual
ms.subservice: itpro-deploy
appliesto:
diff --git a/windows/deployment/usmt/usmt-migrate-efs-files-and-certificates.md b/windows/deployment/usmt/usmt-migrate-efs-files-and-certificates.md
index 39944f9a6a..8d146557a2 100644
--- a/windows/deployment/usmt/usmt-migrate-efs-files-and-certificates.md
+++ b/windows/deployment/usmt/usmt-migrate-efs-files-and-certificates.md
@@ -6,7 +6,7 @@ manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
-ms.date: 01/09/2024
+ms.date: 01/29/2025
ms.topic: conceptual
ms.subservice: itpro-deploy
appliesto:
diff --git a/windows/deployment/usmt/usmt-migrate-user-accounts.md b/windows/deployment/usmt/usmt-migrate-user-accounts.md
index 41f319446d..2e82b3db4e 100644
--- a/windows/deployment/usmt/usmt-migrate-user-accounts.md
+++ b/windows/deployment/usmt/usmt-migrate-user-accounts.md
@@ -6,7 +6,7 @@ manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
-ms.date: 01/09/2024
+ms.date: 01/29/2025
ms.topic: conceptual
ms.subservice: itpro-deploy
appliesto:
diff --git a/windows/deployment/usmt/usmt-migration-store-encryption.md b/windows/deployment/usmt/usmt-migration-store-encryption.md
index b5dc3eb5fe..2084dbdd22 100644
--- a/windows/deployment/usmt/usmt-migration-store-encryption.md
+++ b/windows/deployment/usmt/usmt-migration-store-encryption.md
@@ -6,7 +6,7 @@ manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
-ms.date: 01/09/2024
+ms.date: 01/29/2025
ms.topic: conceptual
ms.subservice: itpro-deploy
appliesto:
diff --git a/windows/deployment/usmt/usmt-overview.md b/windows/deployment/usmt/usmt-overview.md
index f0023bfc0b..0e8726cf9a 100644
--- a/windows/deployment/usmt/usmt-overview.md
+++ b/windows/deployment/usmt/usmt-overview.md
@@ -7,7 +7,7 @@ author: frankroj
ms.reviewer: kevinmi,warrenw
manager: aaroncz
ms.author: frankroj
-ms.date: 01/09/2024
+ms.date: 01/29/2025
ms.topic: overview
ms.collection:
- highpri
diff --git a/windows/deployment/usmt/usmt-plan-your-migration.md b/windows/deployment/usmt/usmt-plan-your-migration.md
index 20bbc09ad5..6fbc90a488 100644
--- a/windows/deployment/usmt/usmt-plan-your-migration.md
+++ b/windows/deployment/usmt/usmt-plan-your-migration.md
@@ -6,7 +6,7 @@ manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
-ms.date: 01/09/2024
+ms.date: 01/29/2025
ms.topic: conceptual
ms.subservice: itpro-deploy
appliesto:
diff --git a/windows/deployment/usmt/usmt-recognized-environment-variables.md b/windows/deployment/usmt/usmt-recognized-environment-variables.md
index 0d2153bbaa..74170fceed 100644
--- a/windows/deployment/usmt/usmt-recognized-environment-variables.md
+++ b/windows/deployment/usmt/usmt-recognized-environment-variables.md
@@ -7,7 +7,7 @@ ms.reviewer: kevinmi,warrenw
manager: aaroncz
ms.author: frankroj
author: frankroj
-ms.date: 01/09/2024
+ms.date: 01/29/2025
ms.topic: conceptual
ms.collection:
- highpri
diff --git a/windows/deployment/usmt/usmt-reference.md b/windows/deployment/usmt/usmt-reference.md
index 9581170803..adeaf3c10e 100644
--- a/windows/deployment/usmt/usmt-reference.md
+++ b/windows/deployment/usmt/usmt-reference.md
@@ -6,7 +6,7 @@ manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
-ms.date: 01/09/2024
+ms.date: 01/29/2025
ms.topic: conceptual
ms.subservice: itpro-deploy
appliesto:
diff --git a/windows/deployment/usmt/usmt-requirements.md b/windows/deployment/usmt/usmt-requirements.md
index 26b5f86f7a..438b71d40b 100644
--- a/windows/deployment/usmt/usmt-requirements.md
+++ b/windows/deployment/usmt/usmt-requirements.md
@@ -6,7 +6,7 @@ manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
-ms.date: 04/30/2024
+ms.date: 01/29/2025
ms.topic: conceptual
ms.subservice: itpro-deploy
appliesto:
diff --git a/windows/deployment/usmt/usmt-reroute-files-and-settings.md b/windows/deployment/usmt/usmt-reroute-files-and-settings.md
index f002c6d337..e7a5305f00 100644
--- a/windows/deployment/usmt/usmt-reroute-files-and-settings.md
+++ b/windows/deployment/usmt/usmt-reroute-files-and-settings.md
@@ -6,7 +6,7 @@ manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
-ms.date: 01/09/2024
+ms.date: 01/29/2025
ms.topic: conceptual
ms.subservice: itpro-deploy
appliesto:
@@ -70,7 +70,7 @@ The following custom **.xml** file reroutes **.mp3** files located in the fixed
-
+
```
## Reroute a specific file
@@ -83,8 +83,8 @@ The following custom **.xml** file migrates the `Sample.doc` file from `C:\Engin
Sample.doc into the Documents folder
-
-
+
+
C:\EngineeringDrafts\ [Sample.doc]
diff --git a/windows/deployment/usmt/usmt-resources.md b/windows/deployment/usmt/usmt-resources.md
index 239d7be582..6e81c92b9a 100644
--- a/windows/deployment/usmt/usmt-resources.md
+++ b/windows/deployment/usmt/usmt-resources.md
@@ -6,7 +6,7 @@ manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
-ms.date: 01/09/2024
+ms.date: 01/29/2025
ms.topic: conceptual
ms.subservice: itpro-deploy
appliesto:
@@ -23,7 +23,7 @@ appliesto:
- Microsoft Visual Studio
- The User State Migration Tool (USMT) XML schema (the `MigXML.xsd` file) can be used to validate the migration **.xml** files using an XML authoring tool such as Microsoft Visual Studio.
-
+
For more information about how to use the schema with an XML authoring environment, see the environment's documentation.
- [Ask the Directory Services Team blog](https://techcommunity.microsoft.com/t5/ask-the-directory-services-team/bg-p/AskDS).
diff --git a/windows/deployment/usmt/usmt-scanstate-syntax.md b/windows/deployment/usmt/usmt-scanstate-syntax.md
index 24f73b72d1..a25a4bde8e 100644
--- a/windows/deployment/usmt/usmt-scanstate-syntax.md
+++ b/windows/deployment/usmt/usmt-scanstate-syntax.md
@@ -6,7 +6,7 @@ manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
-ms.date: 04/30/2024
+ms.date: 01/29/2025
ms.topic: conceptual
ms.subservice: itpro-deploy
appliesto:
diff --git a/windows/deployment/usmt/usmt-technical-reference.md b/windows/deployment/usmt/usmt-technical-reference.md
index 1254f4fef0..d269cd7597 100644
--- a/windows/deployment/usmt/usmt-technical-reference.md
+++ b/windows/deployment/usmt/usmt-technical-reference.md
@@ -6,7 +6,7 @@ manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
-ms.date: 01/09/2024
+ms.date: 01/29/2025
ms.topic: conceptual
ms.subservice: itpro-deploy
appliesto:
diff --git a/windows/deployment/usmt/usmt-test-your-migration.md b/windows/deployment/usmt/usmt-test-your-migration.md
index 57767aecf4..4b1d005a41 100644
--- a/windows/deployment/usmt/usmt-test-your-migration.md
+++ b/windows/deployment/usmt/usmt-test-your-migration.md
@@ -6,7 +6,7 @@ manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
-ms.date: 01/09/2024
+ms.date: 01/29/2025
ms.topic: conceptual
ms.subservice: itpro-deploy
appliesto:
diff --git a/windows/deployment/usmt/usmt-topics.md b/windows/deployment/usmt/usmt-topics.md
index e3be3d8fd0..56ee8a1868 100644
--- a/windows/deployment/usmt/usmt-topics.md
+++ b/windows/deployment/usmt/usmt-topics.md
@@ -6,7 +6,7 @@ manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
-ms.date: 01/09/2024
+ms.date: 01/29/2025
ms.topic: conceptual
ms.subservice: itpro-deploy
appliesto:
diff --git a/windows/deployment/usmt/usmt-troubleshooting.md b/windows/deployment/usmt/usmt-troubleshooting.md
index 3e85b84a37..3ca79322a4 100644
--- a/windows/deployment/usmt/usmt-troubleshooting.md
+++ b/windows/deployment/usmt/usmt-troubleshooting.md
@@ -6,7 +6,7 @@ manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
-ms.date: 01/09/2024
+ms.date: 01/29/2025
ms.topic: conceptual
ms.subservice: itpro-deploy
appliesto:
diff --git a/windows/deployment/usmt/usmt-utilities.md b/windows/deployment/usmt/usmt-utilities.md
index 20c70db094..bef1f41088 100644
--- a/windows/deployment/usmt/usmt-utilities.md
+++ b/windows/deployment/usmt/usmt-utilities.md
@@ -6,7 +6,7 @@ manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
-ms.date: 01/09/2024
+ms.date: 01/29/2025
ms.topic: conceptual
ms.subservice: itpro-deploy
appliesto:
diff --git a/windows/deployment/usmt/usmt-what-does-usmt-migrate.md b/windows/deployment/usmt/usmt-what-does-usmt-migrate.md
index e03e8db9c0..56cee12f98 100644
--- a/windows/deployment/usmt/usmt-what-does-usmt-migrate.md
+++ b/windows/deployment/usmt/usmt-what-does-usmt-migrate.md
@@ -6,7 +6,7 @@ manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
-ms.date: 01/18/2024
+ms.date: 01/29/2025
ms.topic: conceptual
ms.subservice: itpro-deploy
appliesto:
diff --git a/windows/deployment/usmt/usmt-xml-elements-library.md b/windows/deployment/usmt/usmt-xml-elements-library.md
index a4694c75a9..fc41899980 100644
--- a/windows/deployment/usmt/usmt-xml-elements-library.md
+++ b/windows/deployment/usmt/usmt-xml-elements-library.md
@@ -6,7 +6,7 @@ manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
-ms.date: 01/09/2024
+ms.date: 01/29/2025
ms.topic: conceptual
ms.subservice: itpro-deploy
appliesto:
@@ -95,7 +95,7 @@ The following example is from the `MigApp.xml` file:
%HklmWowSoftware%\Microsoft\Office\16.0\Common\Migration\Office [Lang]
DWORD
00000000
-
+
```
## \
@@ -127,7 +127,7 @@ The following example is from the `MigApp.xml` file:
%HklmWowSoftware%\Microsoft\Office\16.0\Common\Migration\Office [Lang]
DWORD
00000000
-
+
```
## \
@@ -1070,10 +1070,10 @@ Example:
-
DOC
@@ -1126,18 +1126,18 @@ Syntax:
For example, to migrate all \*.doc files from the source computer, specifying the following code under the **\** element:
```xml
-
- doc
-
+
+ doc
+
```
is the same as specifying the following code below the **\** element:
```xml
-
-
-
-
+
+
+
+
```
@@ -1202,7 +1202,7 @@ The following example is from the `MigUser.xml` file:
%CSIDL_MYVIDEO%
-
+
MigXmlHelper.DoesObjectExist("File","%CSIDL_MYVIDEO%")
@@ -1702,11 +1702,11 @@ The following example is from the `MigUser.xml` file:
%CSIDL_MYMUSIC%
-
+
MigXmlHelper.DoesObjectExist("File","%CSIDL_MYMUSIC%")
-
+
@@ -1846,11 +1846,11 @@ The following example is from the `MigUser.xml` file. For more examples, see the
%CSIDL_STARTMENU%
-
+
MigXmlHelper.DoesObjectExist("File","%CSIDL_STARTMENU%")
-
+
@@ -1901,11 +1901,11 @@ The following example is from the `MigUser.xml` file:
%CSIDL_MYMUSIC%
-
+
MigXmlHelper.DoesObjectExist("File","%CSIDL_MYMUSIC%")
-
+
@@ -1969,7 +1969,7 @@ Examples:
To migrate the Sample.doc file from any drive on the source computer, use **\
+
```
For more examples of how to use this element, see [Exclude Files and Settings](usmt-exclude-files-and-settings.md), [Reroute Files and Settings](usmt-reroute-files-and-settings.md), and [Custom XML Examples](usmt-custom-xml-examples.md).
@@ -2171,7 +2171,7 @@ For example:
```xml
- %CSIDL_COMMON_APPDATA%\QuickTime
+ %CSIDL_COMMON_APPDATA%\QuickTime
```
@@ -2204,7 +2204,7 @@ The following **.xml** file excludes all `.mp3` files from migration. For additi
-
+
diff --git a/windows/deployment/usmt/usmt-xml-reference.md b/windows/deployment/usmt/usmt-xml-reference.md
index 3b1f32fc27..21d2195393 100644
--- a/windows/deployment/usmt/usmt-xml-reference.md
+++ b/windows/deployment/usmt/usmt-xml-reference.md
@@ -6,7 +6,7 @@ manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
-ms.date: 01/09/2024
+ms.date: 01/29/2025
ms.topic: conceptual
ms.subservice: itpro-deploy
appliesto:
diff --git a/windows/deployment/usmt/verify-the-condition-of-a-compressed-migration-store.md b/windows/deployment/usmt/verify-the-condition-of-a-compressed-migration-store.md
index 818a24659e..f611d55175 100644
--- a/windows/deployment/usmt/verify-the-condition-of-a-compressed-migration-store.md
+++ b/windows/deployment/usmt/verify-the-condition-of-a-compressed-migration-store.md
@@ -6,7 +6,7 @@ manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
-ms.date: 01/09/2024
+ms.date: 01/29/2025
ms.topic: conceptual
ms.subservice: itpro-deploy
appliesto:
diff --git a/windows/deployment/usmt/xml-file-requirements.md b/windows/deployment/usmt/xml-file-requirements.md
index 7d1969ad11..8b1d97b433 100644
--- a/windows/deployment/usmt/xml-file-requirements.md
+++ b/windows/deployment/usmt/xml-file-requirements.md
@@ -6,7 +6,7 @@ manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
-ms.date: 01/09/2024
+ms.date: 01/29/2025
ms.topic: conceptual
ms.subservice: itpro-deploy
appliesto:
From c809361069aa33717ca0c5527ab82c16c5346d0a Mon Sep 17 00:00:00 2001
From: Frank Rojas <45807133+frankroj@users.noreply.github.com>
Date: Wed, 29 Jan 2025 15:50:59 -0500
Subject: [PATCH 33/86] Update review date on reviewed articles 2
---
windows/deployment/upgrade/log-files.md | 2 +-
windows/deployment/upgrade/resolve-windows-upgrade-errors.md | 2 +-
windows/deployment/upgrade/setupdiag.md | 4 ++--
windows/deployment/upgrade/submit-errors.md | 2 +-
windows/deployment/upgrade/windows-error-reporting.md | 4 ++--
windows/deployment/upgrade/windows-upgrade-paths.md | 2 +-
6 files changed, 8 insertions(+), 8 deletions(-)
diff --git a/windows/deployment/upgrade/log-files.md b/windows/deployment/upgrade/log-files.md
index 5da693649e..d8dc167a04 100644
--- a/windows/deployment/upgrade/log-files.md
+++ b/windows/deployment/upgrade/log-files.md
@@ -11,7 +11,7 @@ ms.collection:
- highpri
- tier2
ms.subservice: itpro-deploy
-ms.date: 01/18/2024
+ms.date: 01/29/2025
appliesto:
- ✅ Windows 11
- ✅ Windows 10
diff --git a/windows/deployment/upgrade/resolve-windows-upgrade-errors.md b/windows/deployment/upgrade/resolve-windows-upgrade-errors.md
index da72341ab0..444ff9cf37 100644
--- a/windows/deployment/upgrade/resolve-windows-upgrade-errors.md
+++ b/windows/deployment/upgrade/resolve-windows-upgrade-errors.md
@@ -8,7 +8,7 @@ ms.localizationpriority: medium
ms.topic: conceptual
ms.service: windows-client
ms.subservice: itpro-deploy
-ms.date: 01/18/2024
+ms.date: 01/29/2025
appliesto:
- ✅ Windows 11
- ✅ Windows 10
diff --git a/windows/deployment/upgrade/setupdiag.md b/windows/deployment/upgrade/setupdiag.md
index 00ae1403ff..c66b48114b 100644
--- a/windows/deployment/upgrade/setupdiag.md
+++ b/windows/deployment/upgrade/setupdiag.md
@@ -12,7 +12,7 @@ ms.topic: troubleshooting
ms.collection:
- highpri
- tier2
-ms.date: 01/18/2024
+ms.date: 01/29/2025
appliesto:
- ✅ Windows 11
- ✅ Windows 10
@@ -479,7 +479,7 @@ Refer to "https://learn.microsoft.com/windows/desktop/Debug/system-error-codes"
"FailureDetails":"Err = 0x00000057, LastOperation = Gather data, scope: EVERYTHING, LastPhase = Downlevel",
"DeviceDriverInfo":null,
"Remediation":[
-
+
],
"SetupPhaseInfo":null,
"SetupOperationInfo":null
diff --git a/windows/deployment/upgrade/submit-errors.md b/windows/deployment/upgrade/submit-errors.md
index 48726194a2..5caad8feef 100644
--- a/windows/deployment/upgrade/submit-errors.md
+++ b/windows/deployment/upgrade/submit-errors.md
@@ -8,7 +8,7 @@ author: frankroj
ms.localizationpriority: medium
ms.topic: conceptual
ms.subservice: itpro-deploy
-ms.date: 01/18/2024
+ms.date: 01/29/2025
appliesto:
- ✅ Windows 11
- ✅ Windows 10
diff --git a/windows/deployment/upgrade/windows-error-reporting.md b/windows/deployment/upgrade/windows-error-reporting.md
index c7251d75b2..34c5e47773 100644
--- a/windows/deployment/upgrade/windows-error-reporting.md
+++ b/windows/deployment/upgrade/windows-error-reporting.md
@@ -8,7 +8,7 @@ author: frankroj
ms.localizationpriority: medium
ms.topic: conceptual
ms.subservice: itpro-deploy
-ms.date: 01/18/2024
+ms.date: 01/29/2025
appliesto:
- ✅ Windows 11
- ✅ Windows 10
@@ -18,7 +18,7 @@ appliesto:
> [!NOTE]
>
-> This article is a 300 level article (moderately advanced).
+> This article is a 300 level article (moderately advanced).
>
> See [Resolve Windows upgrade errors](resolve-windows-upgrade-errors.md) for a full list of articles in this section.
diff --git a/windows/deployment/upgrade/windows-upgrade-paths.md b/windows/deployment/upgrade/windows-upgrade-paths.md
index 1033866907..4d1dcd205e 100644
--- a/windows/deployment/upgrade/windows-upgrade-paths.md
+++ b/windows/deployment/upgrade/windows-upgrade-paths.md
@@ -11,7 +11,7 @@ ms.collection:
- highpri
- tier2
ms.subservice: itpro-deploy
-ms.date: 02/13/2024
+ms.date: 01/29/2025
appliesto:
- ✅ Windows 10
- ✅ Windows 11
From 360ec467a50435d5adb48f151b8fef010140652e Mon Sep 17 00:00:00 2001
From: Ruchika Mittal
Date: Thu, 30 Jan 2025 02:37:19 +0530
Subject: [PATCH 34/86] Fix numbering
---
windows/deployment/upgrade/log-files.md | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/windows/deployment/upgrade/log-files.md b/windows/deployment/upgrade/log-files.md
index d8dc167a04..78f9f1690b 100644
--- a/windows/deployment/upgrade/log-files.md
+++ b/windows/deployment/upgrade/log-files.md
@@ -51,13 +51,13 @@ A `setupact.log` or `setuperr.log` entry includes the following elements:
1. **The date and time** - 2023-09-08 09:20:05
-1. **The log level** - Info, Warning, Error, Fatal Error
+2. **The log level** - Info, Warning, Error, Fatal Error
-1. **The logging component** - CONX, MOUPG, PANTHR, SP, IBSLIB, MIG, DISM, CSI, CBS
+3. **The logging component** - CONX, MOUPG, PANTHR, SP, IBSLIB, MIG, DISM, CSI, CBS
The logging components SP (setup platform), MIG (migration engine), and CONX (compatibility information) are useful for troubleshooting Windows Setup errors.
-1. **The message** - Operation completed successfully.
+4. **The message** - Operation completed successfully.
See the following example:
From e9ca0075d60a6f39fd5d7a598e2e6fa3544519b2 Mon Sep 17 00:00:00 2001
From: Rebecca Agiewich <16087112+rjagiewich@users.noreply.github.com>
Date: Wed, 29 Jan 2025 15:21:24 -0800
Subject: [PATCH 35/86] UI updates
---
.acrolinx-config.edn | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/.acrolinx-config.edn b/.acrolinx-config.edn
index 2794193b88..3e58e829a1 100644
--- a/.acrolinx-config.edn
+++ b/.acrolinx-config.edn
@@ -39,7 +39,7 @@ For more information about the exception criteria and exception process, see [Mi
Select the total score link to review all feedback on clarity, consistency, tone, brand, terms, spelling, grammar, readability, and inclusive language. _You should fix all spelling errors regardless of your total score_. Fixing spelling errors helps maintain customer trust in overall content quality.
-| Article | Total score
(Required: 80) | Words + phrases
(Brand, terms) | Correctness
(Spelling, grammar) | Clarity
(Readability) |
+| Article | Total score
(Required: 80) | Terminology | Spelling and Grammar| Clarity
(Readability) |
|---------|:--------------:|:--------------------:|:------:|:---------:|
"
From 121a3e9d45e2ab05d43d26476bd551962a1ae31f Mon Sep 17 00:00:00 2001
From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com>
Date: Wed, 29 Jan 2025 17:50:01 -0700
Subject: [PATCH 36/86] Update docfx.json
---
windows/security/docfx.json | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/windows/security/docfx.json b/windows/security/docfx.json
index e0cd0064c8..eebfabaaa0 100644
--- a/windows/security/docfx.json
+++ b/windows/security/docfx.json
@@ -142,9 +142,10 @@
"✅ Windows Server 2019",
"✅ Windows Server 2016"
],
- "application-security/application-control/windows-defender-application-control/**/*.md": [
+ "application-security/application-control/app-control-for-business/**/*.md": [
"✅ Windows 11",
"✅ Windows 10",
+ "✅ Windows Server 2025",
"✅ Windows Server 2022",
"✅ Windows Server 2019",
"✅ Windows Server 2016"
From 1a4d132553d6a0547cd66007fb6f34ea04083423 Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Thu, 30 Jan 2025 10:01:58 -0800
Subject: [PATCH 37/86] edits and use include file
---
.../catalog-checkpoint-cumulative-updates.md | 2 +-
.../includes/checkpoint-cumulative-updates.md | 17 ++++++++++++++++
windows/deployment/update/release-cycle.md | 20 ++++++++-----------
3 files changed, 26 insertions(+), 13 deletions(-)
create mode 100644 windows/deployment/update/includes/checkpoint-cumulative-updates.md
diff --git a/windows/deployment/update/catalog-checkpoint-cumulative-updates.md b/windows/deployment/update/catalog-checkpoint-cumulative-updates.md
index a537aea3fa..cef752e648 100644
--- a/windows/deployment/update/catalog-checkpoint-cumulative-updates.md
+++ b/windows/deployment/update/catalog-checkpoint-cumulative-updates.md
@@ -13,7 +13,7 @@ ms.localizationpriority: medium
appliesto:
- ✅ Windows 11, version 24H2 and later
- ✅ Windows Server 2025
-ms.date: 01/27/2025
+ms.date: 01/30/2025
---
# Checkpoint cumulative updates and Microsoft Update Catalog usage
diff --git a/windows/deployment/update/includes/checkpoint-cumulative-updates.md b/windows/deployment/update/includes/checkpoint-cumulative-updates.md
new file mode 100644
index 0000000000..9e266ddb65
--- /dev/null
+++ b/windows/deployment/update/includes/checkpoint-cumulative-updates.md
@@ -0,0 +1,17 @@
+---
+author: mestew
+ms.author: mstewart
+manager: aaroncz
+ms.subservice: itpro-updates
+ms.service: windows-client
+ms.topic: include
+ms.date: 01/30/2025
+ms.localizationpriority: medium
+---
+
+
+Starting Windows 11, version 24H2, Microsoft may periodically release cumulative updates as checkpoints. The subsequent updates will consist of:
+- The update package files associated with the checkpoints, and
+- New update package files that contain incremental binary differentials against the version of binaries in the last checkpoint.
+
+Multiple checkpoints may be shipped during the lifecycle of a given Windows release. Devices updating from Windows Update and WSUS can continue to seamlessly install the latest monthly security update regardless of whether there are any preceding checkpoint cumulative updates, **no change is needed to their update process**. Catalog users can review [Checkpoint cumulative updates and Microsoft Update Catalog usage](catalog-checkpoint-cumulative-updates.md) for reference.
diff --git a/windows/deployment/update/release-cycle.md b/windows/deployment/update/release-cycle.md
index 7df3d99935..449627bbbe 100644
--- a/windows/deployment/update/release-cycle.md
+++ b/windows/deployment/update/release-cycle.md
@@ -11,7 +11,7 @@ ms.localizationpriority: medium
appliesto:
- ✅ Windows 11
- ✅ Windows 10
-ms.date: 01/27/2025
+ms.date: 01/30/2025
---
# Update release cycle for Windows clients
@@ -54,13 +54,8 @@ Monthly security update releases are available through the following channels:
Many update management tools, such as [Microsoft Configuration Manager](/mem/configmgr/) and [Microsoft Intune](/mem/intune/), rely on these channels for update deployment.
-Starting Windows 11, version 24H2, Microsoft may periodically release cumulative updates as checkpoints. The subsequent updates will consist of:
-- The update package files associated with the checkpoints, and
-- New update package files that contain incremental binary differentials against the version of binaries in the last checkpoint.
-
-Multiple checkpoints may be shipped during the lifecycle of a given Windows release. Devices updating from Windows Update and WSUS can continue to seamlessly install the latest monthly security update regardless of whether there are any preceding checkpoint cumulative updates, **no change is needed to their update process**. Catalog users can review [Checkpoint cumulative updates and Microsoft Update Catalog usage](catalog-checkpoint-cumulative-updates.md) for reference.
-
-
+
+[!INCLUDE [Checkpoint cumulative updates](./includes/checkpoint-cumulative-updates.md)]
## Optional nonsecurity preview release
@@ -78,11 +73,9 @@ To access the optional nonsecurity preview release:
- Use [Windows Insider Program for Business](https://insider.windows.com/for-business)
- Use the [Microsoft Update Catalog](https://www.catalog.update.microsoft.com/Home.aspx).
-Starting Windows 11, version 24H2, Microsoft may periodically release cumulative updates as checkpoints. The subsequent updates will consist of:
-- The update package files associated with the checkpoints, and
-- New update package files that contain incremental binary differentials against the version of binaries in the last checkpoint.
+
+[!INCLUDE [Checkpoint cumulative updates](./includes/checkpoint-cumulative-updates.md)]
-Multiple checkpoints may be shipped during the lifecycle of a given Windows release. Devices updating from Windows Update and WSUS can continue to seamlessly install the latest monthly security update regardless of whether there are any preceding checkpoint cumulative updates, **no change is needed to their update process**. Catalog users can review [Checkpoint cumulative updates and Microsoft Update Catalog usage](catalog-checkpoint-cumulative-updates.md) for reference.
## OOB releases
@@ -97,6 +90,9 @@ Some key considerations about OOB releases include:
- Critical OOB releases are automatically available to WSUS and Windows Update for Business, just like the monthly security update releases.
- Some OOB releases are classified as noncritical.
- Noncritical releases only go to the Microsoft Update Catalog for users or organizations to voluntarily obtain the update.
+
+
+[!INCLUDE [Checkpoint cumulative updates](./includes/checkpoint-cumulative-updates.md)]
## Continuous innovation for Windows 11
From 453ad36bf40b41e29f18af5d1cc9621ab4184e93 Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Thu, 30 Jan 2025 10:07:34 -0800
Subject: [PATCH 38/86] fix link
---
.../deployment/update/includes/checkpoint-cumulative-updates.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/deployment/update/includes/checkpoint-cumulative-updates.md b/windows/deployment/update/includes/checkpoint-cumulative-updates.md
index 9e266ddb65..c1be20d788 100644
--- a/windows/deployment/update/includes/checkpoint-cumulative-updates.md
+++ b/windows/deployment/update/includes/checkpoint-cumulative-updates.md
@@ -14,4 +14,4 @@ Starting Windows 11, version 24H2, Microsoft may periodically release cumulative
- The update package files associated with the checkpoints, and
- New update package files that contain incremental binary differentials against the version of binaries in the last checkpoint.
-Multiple checkpoints may be shipped during the lifecycle of a given Windows release. Devices updating from Windows Update and WSUS can continue to seamlessly install the latest monthly security update regardless of whether there are any preceding checkpoint cumulative updates, **no change is needed to their update process**. Catalog users can review [Checkpoint cumulative updates and Microsoft Update Catalog usage](catalog-checkpoint-cumulative-updates.md) for reference.
+Multiple checkpoints may be shipped during the lifecycle of a given Windows release. Devices updating from Windows Update and WSUS can continue to seamlessly install the latest monthly security update regardless of whether there are any preceding checkpoint cumulative updates, **no change is needed to their update process**. Catalog users can review [Checkpoint cumulative updates and Microsoft Update Catalog usage](../catalog-checkpoint-cumulative-updates.md) for reference.
From 0df087627d8d8bf258704d57f22a68134130860d Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Thu, 30 Jan 2025 13:36:49 -0500
Subject: [PATCH 39/86] script variable update
---
.../passwordless-strategy/journey-step-3.md | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/windows/security/identity-protection/passwordless-strategy/journey-step-3.md b/windows/security/identity-protection/passwordless-strategy/journey-step-3.md
index 9bc006a4e0..46402af58c 100644
--- a/windows/security/identity-protection/passwordless-strategy/journey-step-3.md
+++ b/windows/security/identity-protection/passwordless-strategy/journey-step-3.md
@@ -2,7 +2,7 @@
title: Transition into a passwordless deployment
description: Learn about how to transition into a passwordless deployment, the third step of the Microsoft passwordless journey.
ms.topic: concept-article
-ms.date: 10/29/2024
+ms.date: 01/30/2025
---
# Transition into a passwordless deployment
@@ -123,7 +123,7 @@ function Generate-RandomPassword{
$NewPassword = ConvertTo-SecureString -String (Generate-RandomPassword) -AsPlainText -Force
-Set-ADAccountPassword -identity $userId -NewPassword $NewPassword -Reset
+Set-ADAccountPassword -identity $samAccountName = -NewPassword $NewPassword -Reset
```
If your organizational policies allow it, you can configure the randomized passwords to never expire, or use a long expiration period. This configuration prevents the user from being prompted to change their password.
From 1007a030d7c902902a9f7d4c6aeb505a8b7df216 Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Thu, 30 Jan 2025 13:43:07 -0500
Subject: [PATCH 40/86] fix
---
.../identity-protection/passwordless-strategy/journey-step-3.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/security/identity-protection/passwordless-strategy/journey-step-3.md b/windows/security/identity-protection/passwordless-strategy/journey-step-3.md
index 46402af58c..3d3f9622e0 100644
--- a/windows/security/identity-protection/passwordless-strategy/journey-step-3.md
+++ b/windows/security/identity-protection/passwordless-strategy/journey-step-3.md
@@ -123,7 +123,7 @@ function Generate-RandomPassword{
$NewPassword = ConvertTo-SecureString -String (Generate-RandomPassword) -AsPlainText -Force
-Set-ADAccountPassword -identity $samAccountName = -NewPassword $NewPassword -Reset
+Set-ADAccountPassword -identity $samAccountName -NewPassword $NewPassword -Reset
```
If your organizational policies allow it, you can configure the randomized passwords to never expire, or use a long expiration period. This configuration prevents the user from being prompted to change their password.
From c017ce9ba4e83117530c3448bd5db16aa947f36a Mon Sep 17 00:00:00 2001
From: StevenHosking-Msft
<64120663+StevenHosking-Msft@users.noreply.github.com>
Date: Fri, 31 Jan 2025 10:33:54 +1100
Subject: [PATCH 41/86] Update windows-autopatch-configure-network.md
---
.../prepare/windows-autopatch-configure-network.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/deployment/windows-autopatch/prepare/windows-autopatch-configure-network.md b/windows/deployment/windows-autopatch/prepare/windows-autopatch-configure-network.md
index 8ba74fe797..c3c115d488 100644
--- a/windows/deployment/windows-autopatch/prepare/windows-autopatch-configure-network.md
+++ b/windows/deployment/windows-autopatch/prepare/windows-autopatch-configure-network.md
@@ -63,7 +63,7 @@ The following URLs must be on the allowed list of your proxy and firewall so tha
| Microsoft service | URLs required on allowlist |
| ----- | ----- |
-| Windows Autopatch | - mmdcustomer.microsoft.com
- mmdls.microsoft.com
- logcollection.mmd.microsoft.com
- support.mmd.microsoft.com
- devicelistenerprod.microsoft.com
- login.windows.net
- payloadprod*.blob.core.windows.net
- device.autopatch.microsoft.com
|
+| Windows Autopatch | - mmdcustomer.microsoft.com
- mmdls.microsoft.com
- logcollection.mmd.microsoft.com
- support.mmd.microsoft.com
- devicelistenerprod.microsoft.com
- login.windows.net
- device.autopatch.microsoft.com
|
## Delivery Optimization
From 746a55a558255fa98a24c552ec4e49a653707c65 Mon Sep 17 00:00:00 2001
From: Rick Munck <33725928+jmunck@users.noreply.github.com>
Date: Fri, 31 Jan 2025 07:47:26 -0600
Subject: [PATCH 42/86] Update security-compliance-toolkit-10.md
Removed reference to Server 2012 R2, Office 2016, Windows 10 20H2.
Added Server 2025
Updated Office baseline to v2412
---
.../security-compliance-toolkit-10.md | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/windows/security/operating-system-security/device-management/windows-security-configuration-framework/security-compliance-toolkit-10.md b/windows/security/operating-system-security/device-management/windows-security-configuration-framework/security-compliance-toolkit-10.md
index ced5288d21..3556919a26 100644
--- a/windows/security/operating-system-security/device-management/windows-security-configuration-framework/security-compliance-toolkit-10.md
+++ b/windows/security/operating-system-security/device-management/windows-security-configuration-framework/security-compliance-toolkit-10.md
@@ -23,18 +23,16 @@ The Security Compliance Toolkit consists of:
- Windows 10 security baselines
- Windows 10, version 22H2
- Windows 10, version 21H2
- - Windows 10, version 20H2
- Windows 10, version 1809
- Windows 10, version 1607
- Windows 10, version 1507
- Windows Server security baselines
+ - Windows Server 2025
- Windows Server 2022
- Windows Server 2019
- Windows Server 2016
- - Windows Server 2012 R2
- Microsoft Office security baseline
- - Office 2016
- - Microsoft 365 Apps for Enterprise Version 2206
+ - Microsoft 365 Apps for Enterprise Version 2412
- Microsoft Edge security baseline
- Microsoft Edge version 128
- Tools
From 56501a2715c401e2beb228aaa26e499e5d14c1e1 Mon Sep 17 00:00:00 2001
From: Rick Munck <33725928+jmunck@users.noreply.github.com>
Date: Fri, 31 Jan 2025 08:12:47 -0600
Subject: [PATCH 43/86] Update get-support-for-security-baselines.md
Updated versions and removed links to SCM
---
.../get-support-for-security-baselines.md | 15 +++------------
1 file changed, 3 insertions(+), 12 deletions(-)
diff --git a/windows/security/operating-system-security/device-management/windows-security-configuration-framework/get-support-for-security-baselines.md b/windows/security/operating-system-security/device-management/windows-security-configuration-framework/get-support-for-security-baselines.md
index 05f61ccf78..75939e36c9 100644
--- a/windows/security/operating-system-security/device-management/windows-security-configuration-framework/get-support-for-security-baselines.md
+++ b/windows/security/operating-system-security/device-management/windows-security-configuration-framework/get-support-for-security-baselines.md
@@ -16,16 +16,7 @@ The Security Compliance Manager (SCM) is now retired and is no longer supported.
More information about this change can be found on the [Microsoft Security Guidance blog](/archive/blogs/secguide/security-compliance-manager-scm-retired-new-tools-and-procedures).
-### Where can I get an older version of a Windows baseline?
-
-Any version of Windows baseline before Windows 10, version 1703, can still be downloaded using SCM. Any future versions of Windows baseline will be available through SCT. See the version matrix in this article to see if your version of Windows baseline is available on SCT.
-
-- [SCM 4.0 Download](/previous-versions/tn-archive/cc936627(v=technet.10))
-- [SCM Frequently Asked Questions (FAQ)](https://social.technet.microsoft.com/wiki/contents/articles/1836.microsoft-security-compliance-manager-scm-frequently-asked-questions-faq.aspx)
-- [SCM Release Notes](https://social.technet.microsoft.com/wiki/contents/articles/1864.microsoft-security-compliance-manager-scm-release-notes.aspx)
-- [SCM baseline download help](https://social.technet.microsoft.com/wiki/contents/articles/1865.microsoft-security-compliance-manager-scm-baseline-download-help.aspx)
-
-### What file formats are supported by the new SCT?
+### What file formats are supported by the SCT?
The toolkit supports formats created by the Windows GPO backup feature (`.pol`, `.inf`, and `.csv`). Policy Analyzer saves its data in XML files with a `.PolicyRules` file extension. LGPO also supports its own LGPO text file format as a text-based analog for the binary registry.pol file format. For more information, see the LGPO documentation. Keep in mind that SCMs' `.cab` files are no longer supported.
@@ -56,16 +47,16 @@ No. SCM supported only SCAP 1.0, which wasn't updated as SCAP evolved. The new t
| Name | Build | Baseline Release Date | Security Tools |
|--|--|--|--|
+| Windows Server 2025 | [SecGuide](https://techcommunity.microsoft.com/blog/microsoft-security-baselines/windows-server-2025-security-baseline/4358733) | January 2025 | [SCT 1.0](https://www.microsoft.com/download/details.aspx?id=55319) |
| Windows Server 2022 | [SecGuide](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/windows-server-2022-security-baseline/ba-p/2724685) | September 2021 | [SCT 1.0](https://www.microsoft.com/download/details.aspx?id=55319) |
| Windows Server 2019 | [SecGuide](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-final-for-windows-10-v1809-and-windows-server/ba-p/701082) | November 2018 | [SCT 1.0](https://www.microsoft.com/download/details.aspx?id=55319) |
| Windows Server 2016 | [SecGuide](/archive/blogs/secguide/security-baseline-for-windows-10-v1607-anniversary-edition-and-windows-server-2016) | October 2016 | [SCT 1.0](https://www.microsoft.com/download/details.aspx?id=55319) |
-| Windows Server 2012 R2 | [SecGuide](/archive/blogs/secguide/security-baseline-for-windows-10-v1607-anniversary-edition-and-windows-server-2016) | August 2014 | [SCT 1.0](https://www.microsoft.com/download/details.aspx?id=55319) |
### Microsoft products
| Name | Details | Security Tools |
|--|--|--|
-| Microsoft 365 Apps for enterprise, version 2306 | [SecGuide](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-for-m365-apps-for-enterprise-v2306/ba-p/3858702) | [SCT 1.0](https://www.microsoft.com/download/details.aspx?id=55319) |
+| Microsoft 365 Apps for enterprise, version 2412 | [SecGuide](https://techcommunity.microsoft.com/blog/microsoft-security-baselines/security-baseline-for-m365-apps-for-enterprise-v2412/4357320) | [SCT 1.0](https://www.microsoft.com/download/details.aspx?id=55319) |
| Microsoft Edge, version 128 | [SecGuide](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-for-microsoft-edge-version-128/ba-p/4237524) | [SCT 1.0](https://www.microsoft.com/download/details.aspx?id=55319) |
## Related articles
From ef635d68903f2bd699414a1e6de8db3fae68c075 Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Fri, 31 Jan 2025 08:39:25 -0800
Subject: [PATCH 44/86] edit
---
.../update/catalog-checkpoint-cumulative-updates.md | 4 ++--
.../update/includes/checkpoint-cumulative-updates.md | 4 ++--
windows/deployment/update/release-cycle.md | 2 +-
3 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/windows/deployment/update/catalog-checkpoint-cumulative-updates.md b/windows/deployment/update/catalog-checkpoint-cumulative-updates.md
index cef752e648..0c3fda339a 100644
--- a/windows/deployment/update/catalog-checkpoint-cumulative-updates.md
+++ b/windows/deployment/update/catalog-checkpoint-cumulative-updates.md
@@ -13,11 +13,11 @@ ms.localizationpriority: medium
appliesto:
- ✅ Windows 11, version 24H2 and later
- ✅ Windows Server 2025
-ms.date: 01/30/2025
+ms.date: 01/31/2025
---
# Checkpoint cumulative updates and Microsoft Update Catalog usage
-
+
Starting Windows 11, version 24H2, monthly security updates and optional nonsecurity preview release updates might be preceded by a checkpoint cumulative update. Devices (and images) updating from Windows Update (WU) and Windows Server Update Services (WSUS) release channels can continue to seamlessly install the latest monthly security update or the optional nonsecurity preview release regardless of whether there are any preceding checkpoint cumulative updates, so **update processes involving WU and WSUS remain unchanged**. This article covers how Microsoft Update Catalog users can easily update their devices (or images) through checkpoint cumulative updates.
## Checkpoint cumulative updates
diff --git a/windows/deployment/update/includes/checkpoint-cumulative-updates.md b/windows/deployment/update/includes/checkpoint-cumulative-updates.md
index c1be20d788..dd9b0e1abd 100644
--- a/windows/deployment/update/includes/checkpoint-cumulative-updates.md
+++ b/windows/deployment/update/includes/checkpoint-cumulative-updates.md
@@ -5,10 +5,10 @@ manager: aaroncz
ms.subservice: itpro-updates
ms.service: windows-client
ms.topic: include
-ms.date: 01/30/2025
+ms.date: 01/31/2025
ms.localizationpriority: medium
---
-
+
Starting Windows 11, version 24H2, Microsoft may periodically release cumulative updates as checkpoints. The subsequent updates will consist of:
- The update package files associated with the checkpoints, and
diff --git a/windows/deployment/update/release-cycle.md b/windows/deployment/update/release-cycle.md
index 449627bbbe..ef01bc96d7 100644
--- a/windows/deployment/update/release-cycle.md
+++ b/windows/deployment/update/release-cycle.md
@@ -11,7 +11,7 @@ ms.localizationpriority: medium
appliesto:
- ✅ Windows 11
- ✅ Windows 10
-ms.date: 01/30/2025
+ms.date: 01/31/2025
---
# Update release cycle for Windows clients
From 14751d75763c5009894ca7922c94a717cbd8761d Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Fri, 31 Jan 2025 09:50:46 -0800
Subject: [PATCH 45/86] edits
---
.../catalog-checkpoint-cumulative-updates.md | 15 +++++++--------
1 file changed, 7 insertions(+), 8 deletions(-)
diff --git a/windows/deployment/update/catalog-checkpoint-cumulative-updates.md b/windows/deployment/update/catalog-checkpoint-cumulative-updates.md
index 0c3fda339a..867e17a256 100644
--- a/windows/deployment/update/catalog-checkpoint-cumulative-updates.md
+++ b/windows/deployment/update/catalog-checkpoint-cumulative-updates.md
@@ -12,13 +12,13 @@ ms.collection:
ms.localizationpriority: medium
appliesto:
- ✅ Windows 11, version 24H2 and later
- - ✅ Windows Server 2025
+ - ✅ Windows Server 2025 and later
ms.date: 01/31/2025
---
# Checkpoint cumulative updates and Microsoft Update Catalog usage
-Starting Windows 11, version 24H2, monthly security updates and optional nonsecurity preview release updates might be preceded by a checkpoint cumulative update. Devices (and images) updating from Windows Update (WU) and Windows Server Update Services (WSUS) release channels can continue to seamlessly install the latest monthly security update or the optional nonsecurity preview release regardless of whether there are any preceding checkpoint cumulative updates, so **update processes involving WU and WSUS remain unchanged**. This article covers how Microsoft Update Catalog users can easily update their devices (or images) through checkpoint cumulative updates.
+Starting Windows 11, version 24H2, monthly security updates and optional nonsecurity preview release updates might be preceded by a checkpoint cumulative update. Devices updating from Windows Update (WU) and Windows Server Update Services (WSUS) release channels can continue to seamlessly install the latest monthly security update or the optional nonsecurity preview release regardless of whether there are any preceding checkpoint cumulative updates, so **update processes involving WU and WSUS remain unchanged**. This article covers how Microsoft Update Catalog users can easily update their devices (or images) through checkpoint cumulative updates.
## Checkpoint cumulative updates
@@ -32,7 +32,7 @@ Going forward, Microsoft might periodically release cumulative updates as checkp
This process might be repeated multiple times, thereby generating multiple checkpoints during the lifecycle of a given Windows release. The Windows 11, version 24H2 servicing stack can merge all the checkpoints and only download and install content that's missing on the device.
-If any checkpoint cumulative updates precede a target update, a device or image needs to take all prior checkpoint cumulative updates before it can take the target update. In other words, a post-checkpoint latest cumulative update can be applied to images/devices that are on that checkpoint or on a subsequent latest cumulative update. For updates sourced from WU and WSUS this process happens seamlessly. You can continue to use the same tools and processes that you currently use for approving and deploying updates.
+If any checkpoint cumulative updates precede a target update, a device or image needs to take all prior checkpoint cumulative updates before it can take the target update. In other words, a post-checkpoint latest cumulative update can be applied to images/devices that are on that checkpoint or on a subsequent latest cumulative update. For updates sourced from WU and WSUS this process happens seamlessly. You can continue to use the same tools and processes that you currently use for approving and deploying updates. We expect that your experience updating through a checkpoint cumulative update will position you to efficiently take future checkpoint cumulative updates.
### Applicability
@@ -40,11 +40,10 @@ A checkpoint cumulative update is just another monthly security update that info
This feature doesn't introduce any change to the applicability of monthly security updates. As before, these updates apply to the main OS (install.wim) and to WinPE (boot.wim) but not to WinRE (winre.wim).
+### Update Windows installation media
+
WinRE is serviced by applying the servicing stack update from a cumulative update (latest cumulative update doesn't apply) and SafeOS Dynamic Update. This is how it has been for a while now, and there's no recent change to WinRE servicing and certainly no change due to the checkpoint cumulative updates feature. We understand that not everybody may have had a shared understanding about this, but applying servicing stack update then SafeOS Dynamic Update is the only way to ensure WinRE is serviced. For more information, see [Update Windows installation media with Dynamic Update](media-dynamic-update.md).
-### Current checkpoint cumulative updates
-
-For Windows 11, version 24H2 and later, for a given update, the knowledge base (KB) article notes all preceding checkpoint cumulative updates under the **Catalog** release channel tab. We expect that your experience updating through a checkpoint cumulative update will position you to efficiently take future checkpoint cumulative updates.
## Updating from the Microsoft Update Catalog
@@ -54,7 +53,7 @@ When installing a given monthly security or optional nonsecurity preview update,
For a given update, users can look up the KB article and find all preceding checkpoints, if any, listed under the **Catalog** release channel. For instance, the 2024-12 monthly security update (KB5048667) has one preceding checkpoint cumulative update per [December 10, 2024-KB5048667 (OS Build 26100.2605)](https://support.microsoft.com/topic/708755a6-d809-4a8a-8d20-53c4108590e6#ID0ELBD=Catalog):
- > Method 2: Install each MSU file individually, in order Download and install each MSU file individually either using DISM or [Windows Update Standalone Installer](https://support.microsoft.com/topic/799ba3df-ec7e-b05e-ee13-1cdae8f23b19) in the following order:
- windows11.0-kb5043080-x64_953449672073f8fb99badb4cc6d5d7849b9c83e8.msu
- windows11.0-kb5048667-x64_d4ad0ca69de9a02bc356757581e0e0d6960c9f93.msu
+ > Install each MSU file individually, in order Download and install each MSU file individually either using DISM or [Windows Update Standalone Installer](https://support.microsoft.com/topic/799ba3df-ec7e-b05e-ee13-1cdae8f23b19) in the following order:
- windows11.0-kb5043080-x64_953449672073f8fb99badb4cc6d5d7849b9c83e8.msu
- windows11.0-kb5048667-x64_d4ad0ca69de9a02bc356757581e0e0d6960c9f93.msu
Alternately, users can search the KB number in the [Microsoft Update Catalog](https://catalog.update.microsoft.com/) and select the **Download** button for the selected architecture. The download pop-up shows all prior checkpoints for the update so that users can conveniently download all `.msu` files and apply them to their image or device. For instance, Microsoft Update Catalog shows the [2024-12 cumulative update (KB5048667)](https://support.microsoft.com/help/5048667) has one preceding checkpoint cumulative update, [KB5043080](https://support.microsoft.com/help/5043080).
@@ -73,7 +72,7 @@ Examples of eligible devices:
**Device needs FoD or language pack customization:**
-Installing FoDs or language packs requires the full latest cumulative update payload, which now can be split across files associated with each preceding checkpoint cumulative update. So, when customizing FoDs or language packs, all prior checkpoint cumulative updates and the target cumulative update need to be installed regardless of whether the device already had any of the prior checkpoints cumulative update installed. This needs to be done using DISM.
+Installing FoDs or language packs requires the full latest cumulative update payload, which now can be split across files associated with each preceding checkpoint cumulative update. So, when customizing FoDs or language packs for offline media, all prior checkpoint cumulative updates and the target cumulative update need to be installed regardless of whether the device already had any of the prior checkpoints cumulative update installed. This needs to be done using DISM.
1. Copy the .msu files of the latest cumulative update (the target) and all prior checkpoint cumulative updates to a local folder. Make sure there are no other .msu files present.
1. Mount the install.wim file.
From bc3239cafdcdd56555b9b42b7cd520fe8d0783ae Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Fri, 31 Jan 2025 10:39:10 -0800
Subject: [PATCH 46/86] Update catalog-checkpoint-cumulative-updates.md
commit
---
.../deployment/update/catalog-checkpoint-cumulative-updates.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/deployment/update/catalog-checkpoint-cumulative-updates.md b/windows/deployment/update/catalog-checkpoint-cumulative-updates.md
index 867e17a256..f92a84a8fa 100644
--- a/windows/deployment/update/catalog-checkpoint-cumulative-updates.md
+++ b/windows/deployment/update/catalog-checkpoint-cumulative-updates.md
@@ -90,4 +90,4 @@ Devices that aren't on the latest checkpoint cumulative update and don't need Fo
- [Servicing stack updates](/windows/deployment/update/servicing-stack-updates)
- [Features on Demand](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities)
- [How to download updates that include drivers and hotfixes from the Microsoft Update Catalog](/troubleshoot/windows-client/installing-updates-features-roles/download-updates-drivers-hotfixes-windows-update-catalog)
-- [Update Windows installation media with Dynamic Update](media-dynamic-update.md)
+- [Update Windows installation media with Dynamic Update](media-dynamic-update.md)
From 248eef82d97bfc706fc386fff79bdc22decbdeef Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Fri, 31 Jan 2025 11:01:47 -0800
Subject: [PATCH 47/86] edits
---
.../deployment/update/catalog-checkpoint-cumulative-updates.md | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/windows/deployment/update/catalog-checkpoint-cumulative-updates.md b/windows/deployment/update/catalog-checkpoint-cumulative-updates.md
index 867e17a256..a4e7755200 100644
--- a/windows/deployment/update/catalog-checkpoint-cumulative-updates.md
+++ b/windows/deployment/update/catalog-checkpoint-cumulative-updates.md
@@ -38,9 +38,10 @@ If any checkpoint cumulative updates precede a target update, a device or image
A checkpoint cumulative update is just another monthly security update that informs how subsequent updates are built. There's no policy change or new requirement around when users must take these updates, though it's best practice to take monthly security updates at the earliest opportunity to keep your devices protected and productive.
+### Update Windows installation media
+
This feature doesn't introduce any change to the applicability of monthly security updates. As before, these updates apply to the main OS (install.wim) and to WinPE (boot.wim) but not to WinRE (winre.wim).
-### Update Windows installation media
WinRE is serviced by applying the servicing stack update from a cumulative update (latest cumulative update doesn't apply) and SafeOS Dynamic Update. This is how it has been for a while now, and there's no recent change to WinRE servicing and certainly no change due to the checkpoint cumulative updates feature. We understand that not everybody may have had a shared understanding about this, but applying servicing stack update then SafeOS Dynamic Update is the only way to ensure WinRE is serviced. For more information, see [Update Windows installation media with Dynamic Update](media-dynamic-update.md).
From dae02a5ae9b4f40a7084d58759f629ee5c5f3c0d Mon Sep 17 00:00:00 2001
From: Mukund Kher
Date: Fri, 31 Jan 2025 11:03:11 -0800
Subject: [PATCH 48/86] Update catalog-checkpoint-cumulative-updates.md
Commit
---
.../update/catalog-checkpoint-cumulative-updates.md | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/windows/deployment/update/catalog-checkpoint-cumulative-updates.md b/windows/deployment/update/catalog-checkpoint-cumulative-updates.md
index 4778484089..c7ba0f378d 100644
--- a/windows/deployment/update/catalog-checkpoint-cumulative-updates.md
+++ b/windows/deployment/update/catalog-checkpoint-cumulative-updates.md
@@ -38,10 +38,9 @@ If any checkpoint cumulative updates precede a target update, a device or image
A checkpoint cumulative update is just another monthly security update that informs how subsequent updates are built. There's no policy change or new requirement around when users must take these updates, though it's best practice to take monthly security updates at the earliest opportunity to keep your devices protected and productive.
-### Update Windows installation media
-
This feature doesn't introduce any change to the applicability of monthly security updates. As before, these updates apply to the main OS (install.wim) and to WinPE (boot.wim) but not to WinRE (winre.wim).
+### Update Windows installation media
WinRE is serviced by applying the servicing stack update from a cumulative update (latest cumulative update doesn't apply) and SafeOS Dynamic Update. This is how it has been for a while now, and there's no recent change to WinRE servicing and certainly no change due to the checkpoint cumulative updates feature. We understand that not everybody may have had a shared understanding about this, but applying servicing stack update then SafeOS Dynamic Update is the only way to ensure WinRE is serviced. For more information, see [Update Windows installation media with Dynamic Update](media-dynamic-update.md).
@@ -84,7 +83,7 @@ Installing FoDs or language packs requires the full latest cumulative update pay
**Device doesn't have the latest checkpoint cumulative update and doesn't need customization:**
-Devices that aren't on the latest checkpoint cumulative update and don't need FoD/language pack customization can either install all needed cumulative updates one by one in the right sequence. Alternately they can be updated using DISM to install all cumulative updates in one go. For more information, see the [Updating through checkpoint cumulative updates](#updating-through-checkpoint-cumulative-updates) section. If there are total four checkpoint cumulative updates available and device already has the first one installed, DISM applies the remaining three checkpoint cumulative updates in the right order followed by the target cumulative update, all in one go.
+Devices that aren't on the latest checkpoint cumulative update and don't need FoD/language pack customization can either install all needed cumulative updates one by one in the right sequence. Alternately they can be updated using DISM to install all cumulative updates in one go. For more information, see the [Updating through checkpoint cumulative updates](#updating-through-checkpoint-cumulative-updates) section. If there are total four checkpoint cumulative updates available and device already has the first one installed, DISM applies the remaining three checkpoint cumulative updates in the right order followed by the target cumulative update, all in one go.
## Related articles
From 53a7beeb303649515112b4542b9efc9494218f8b Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Fri, 31 Jan 2025 11:09:40 -0800
Subject: [PATCH 49/86] edits
---
.../update/catalog-checkpoint-cumulative-updates.md | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/windows/deployment/update/catalog-checkpoint-cumulative-updates.md b/windows/deployment/update/catalog-checkpoint-cumulative-updates.md
index c7ba0f378d..ce4b36fd45 100644
--- a/windows/deployment/update/catalog-checkpoint-cumulative-updates.md
+++ b/windows/deployment/update/catalog-checkpoint-cumulative-updates.md
@@ -38,10 +38,10 @@ If any checkpoint cumulative updates precede a target update, a device or image
A checkpoint cumulative update is just another monthly security update that informs how subsequent updates are built. There's no policy change or new requirement around when users must take these updates, though it's best practice to take monthly security updates at the earliest opportunity to keep your devices protected and productive.
-This feature doesn't introduce any change to the applicability of monthly security updates. As before, these updates apply to the main OS (install.wim) and to WinPE (boot.wim) but not to WinRE (winre.wim).
-
### Update Windows installation media
+This feature doesn't introduce any change to the applicability of monthly security updates. As before, these updates apply to the main OS (install.wim) and to WinPE (boot.wim) but not to WinRE (winre.wim).
+
WinRE is serviced by applying the servicing stack update from a cumulative update (latest cumulative update doesn't apply) and SafeOS Dynamic Update. This is how it has been for a while now, and there's no recent change to WinRE servicing and certainly no change due to the checkpoint cumulative updates feature. We understand that not everybody may have had a shared understanding about this, but applying servicing stack update then SafeOS Dynamic Update is the only way to ensure WinRE is serviced. For more information, see [Update Windows installation media with Dynamic Update](media-dynamic-update.md).
From a01cdb5681bbf0da0da91ac69ec2dbaa420a4e1d Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Fri, 31 Jan 2025 14:09:44 -0800
Subject: [PATCH 50/86] edits
---
.../deployment/update/media-dynamic-update.md | 36 +++++++++----------
1 file changed, 18 insertions(+), 18 deletions(-)
diff --git a/windows/deployment/update/media-dynamic-update.md b/windows/deployment/update/media-dynamic-update.md
index 0ae148a631..33f43d08f6 100644
--- a/windows/deployment/update/media-dynamic-update.md
+++ b/windows/deployment/update/media-dynamic-update.md
@@ -13,7 +13,7 @@ appliesto:
- ✅ Windows 11
- ✅ Windows 10
- ✅ Windows Server
-ms.date: 1/28/2024
+ms.date: 1/31/2024
---
# Update Windows installation media with Dynamic Update
@@ -62,7 +62,7 @@ You can obtain Dynamic Update packages from the [Microsoft Update Catalog](https
|Servicing stack Dynamic Update | YYYY-MM Servicing Stack Update for Microsoft server operating system version 23H2 |
### Azure Stack HCI, version 22H2 Dynamic Update packages
-**Title**, **Product** and **Description** are required to distinguish each Dynamic Package. Latest cumulative update has the servicing stack embedded. Servicing stack published separately only if necessary as a prerequisite for a given cumulative update.
+**Title**, **Product**, and **Description** are required to distinguish each Dynamic Package. Latest cumulative update has the servicing stack embedded. Servicing stack published separately only if necessary as a prerequisite for a given cumulative update.
| Update packages |Title |Product |Description |
|-----------------------------------|----------------------------------------------------------------------------------------|----------------------------------------------|------------------|
@@ -72,7 +72,7 @@ You can obtain Dynamic Update packages from the [Microsoft Update Catalog](https
|Servicing stack Dynamic Update | YYYY-MM Servicing Stack Update for Microsoft server operating system, version 22H2 | | |
### Windows Server 2022 later Dynamic Update packages
-**Title**, **Product** and **Description** are required to distinguish each Dynamic Package. Latest cumulative update has the servicing stack embedded. Servicing stack published separately only if necessary as a prerequisite for a given cumulative update.
+**Title**, **Product**, and **Description** are required to distinguish each Dynamic Package. Latest cumulative update has the servicing stack embedded. Servicing stack published separately only if necessary as a prerequisite for a given cumulative update.
| Update packages |Title |Product |Description |
|-----------------------------------|----------------------------------------------------------------------------------------|----------------------------------------------|------------------|
@@ -81,8 +81,8 @@ You can obtain Dynamic Update packages from the [Microsoft Update Catalog](https
|Latest cumulative update | YYYY-MM Cumulative Update for Microsoft server operating system, version 21H2 | | |
|Servicing stack Dynamic Update | YYYY-MM Servicing Stack Update for Microsoft server operating system, version 21H2 | | |
-### Windows 11, version 22H2 and later Dynamic Update packages
-**Title** can distinguish each Dynamic Package. Latest cumulative updates have the servicing stack embedded. The servicing stack is published only if necessary for a given cumulative update. Titles below are for Windows 11, version 22H2. Windows 11, version 23H2 and 24H2 have a similar format.
+### Windows 11, version 22H2, and later Dynamic Update packages
+**Title** can distinguish each Dynamic Package. Latest cumulative updates have the servicing stack embedded. The servicing stack is published only if necessary for a given cumulative update. The following titles are for Windows 11, version 22H2. Windows 11, version 23H2, and version 24H2 have a similar format:
| Update packages |Title |
|-----------------------------------|---------------------------------------------------------------|
@@ -92,7 +92,7 @@ You can obtain Dynamic Update packages from the [Microsoft Update Catalog](https
|Servicing stack Dynamic Update | YYYY-MM Servicing Stack Update for Windows 11 Version 22H2 |
### Windows 11, version 21H2 Dynamic Update packages
-**Title**, **Product** and **Description** are required to distinguish each Dynamic Package. Latest cumulative update has the servicing stack embedded. Servicing stack published separately only if necessary as a prerequisite for a given cumulative update.
+**Title**, **Product**, and **Description** are required to distinguish each Dynamic Package. Latest cumulative update has the servicing stack embedded. Servicing stack published separately only if necessary as a prerequisite for a given cumulative update.
| Update packages |Title |Product |Description |
|-----------------------------------|---------------------------------------------------------------|----------------------------------------------|------------------|
@@ -102,7 +102,7 @@ You can obtain Dynamic Update packages from the [Microsoft Update Catalog](https
|Servicing stack Dynamic Update | YYYY-MM Servicing Stack Update for Windows 11 Version 21H2 | | |
### Windows 10, version 22H2 Dynamic Update packages
-**Title**, **Product** and **Description** are required to distinguish each Dynamic Package. Latest cumulative update has the servicing stack embedded. Servicing stack published separately only if necessary as a prerequisite for a given cumulative update.
+**Title**, **Product**, and **Description** are required to distinguish each Dynamic Package. Latest cumulative update has the servicing stack embedded. Servicing stack published separately only if necessary as a prerequisite for a given cumulative update.
| Update packages |Title |Product |Description |
|-----------------------------------|---------------------------------------------------------------|----------------------------------------------|------------------|
@@ -136,7 +136,7 @@ This table shows the correct sequence for applying the various tasks to the file
|Add Optional Components | | 12 | | |
|Add Safe OS Dynamic Update | 6 | | | |
|Add Setup Dynamic Update | | | | 26 |
-|Add setup.exe and setuphost.exe from WinPE | | | | 27 |
+|Add Setup.exe and setuphost.exe from WinPE | | | | 27 |
|Add boot manager from WinPE | | | | 28 |
|Add latest cumulative update | | 13 | 23 | |
|Clean up the image | 7 | 14 | 24 | |
@@ -147,7 +147,7 @@ This table shows the correct sequence for applying the various tasks to the file
> Starting in February 2021, the latest cumulative update and servicing stack update is combined and distributed in the Microsoft Update Catalog as a new combined cumulative update. For Steps 1, 9, and 17 that require the servicing stack update for updating the installation media, you should use the combined cumulative update. For more information on the combined cumulative update, see [Servicing stack updates](./servicing-stack-updates.md).
> [!NOTE]
-> Microsoft will remove the Flash component from Windows through KB4577586, "Update for Removal of Adobe Flash Player". You can also remove Flash anytime by deploying the update in KB4577586 (available on the Catalog) between steps 20 and 21. As of July 2021, KB4577586, "Update for Removal of Adobe Flash Player" will be included in the latest cumulative update for Windows 10, versions 1607 and 1507. The update will also be included in the Monthly Rollup and the Security Only Update for Windows 8.1, Windows Server 2012, and Windows Embedded 8 Standard. For more information, see [Update on Adobe Flash Player End of Support](https://blogs.windows.com/msedgedev/2020/09/04/update-adobe-flash-end-support/).
+> Microsoft removes the Flash component from Windows through [KB4577586: Update for Removal of Adobe Flash Player](https://support.microsoft.com/kb/4577586). You can also remove Flash anytime by deploying the update in KB4577586 (available on the Catalog) between steps 20 and 21. As of July 2021, KB4577586, "Update for Removal of Adobe Flash Player" will be included in the latest cumulative update for Windows 10, versions 1607 and 1507. The update will also be included in the Monthly Rollup and the Security Only Update for Windows 8.1, Windows Server 2012, and Windows Embedded 8 Standard. For more information, see [Update on Adobe Flash Player End of Support](https://blogs.windows.com/msedgedev/2020/09/04/update-adobe-flash-end-support/).
### Multiple Windows editions
@@ -157,13 +157,13 @@ The main operating system file (install.wim) might contain multiple editions of
You don't have to add more languages and features to the image to accomplish the updates, but it's an opportunity to customize the image with more languages, Optional Components, and Features on Demand beyond what's in your starting image. When you add more languages and features, it's important to make these changes in the correct order: first apply servicing stack updates, followed by language additions, then by feature additions, and finally the latest cumulative update. The provided sample script installs a second language (in this case Japanese (ja-JP)). Since this language is backed by an lp.cab, there's no need to add a Language Experience Pack. Japanese is added to both the main operating system and to the recovery environment to allow the user to see the recovery screens in Japanese. This includes adding localized versions of the packages currently installed in the recovery image.
-Optional Components, along with the .NET feature, can be installed offline, however doing so creates pending operations that require the device to restart. As a result, the call to perform image cleanup would fail. There are two options to avoid the cleanup failure. One option is to skip the image cleanup step, though that results in a larger install.wim. Another option is to install the .NET and Optional Components in a step after cleanup but before export. This is the option in the sample script. By doing this, you'll have to start with the original install.wim (with no pending actions) when you maintain or update the image the next time (for example, the next month).
+Optional Components, along with the .NET feature, can be installed offline. However, doing so creates pending operations that require the device to restart. As a result, the call to perform image cleanup would fail. There are two options to avoid the cleanup failure. One option is to skip the image cleanup step, though that results in a larger install.wim. Another option is to install the .NET and Optional Components in a step after cleanup but before export. This is the option in the sample script. By doing this, you'll have to start with the original install.wim (with no pending actions) when you maintain or update the image the next time (for example, the next month).
### Checkpoint cumulative updates
-Starting with Windows 11, version 24H2, and Windows Server 2025, the latest cumulative update may have a prerequisite cumulative update that is required to be installed first. These are known as checkpoint cumulative updates. In these cases, the cumulative update file level differentials are based on a previous cumulative update instead of the Windows RTM release. The benefit is a smaller update package and faster installation. When you obtain the latest cumulative update from the [Microsoft Update Catalog](https://catalog.update.microsoft.com), checkpoint cumulative updates will be available from the download button. In addition, the knowledge base article for the cumulative update will provide additional information.
+Starting with Windows 11, version 24H2, and Windows Server 2025, the latest cumulative update might have a prerequisite cumulative update that is required to be installed first. These updates are known as checkpoint cumulative updates. In these cases, the cumulative update file level differentials are based on a previous cumulative update instead of the Windows RTM release. The benefit is a smaller update package and faster installation. When you obtain the latest cumulative update from the [Microsoft Update Catalog](https://catalog.update.microsoft.com), checkpoint cumulative updates are available from the download button. In addition, the knowledge base article for the cumulative update provides additional information.
-To install the checkpoint(s) when servicing the Windows OS (steps 9 & 12) and WinPE (steps 17 & 23), call `Add-WindowsPackage` with the target cumulative update. The folder from `-PackagePath` will be used to discover and install one or more checkpoints as needed. Only the target cumulative update and checkpoint cumulative updates should be in the `-PackagePath` folder. Cumulative update packages with a revision <= the target cumulative update will be processed. If you are not customizing the image with additional languages and/or optional features, then separate calls to `Add-WindowsPackage` (checkpoint cumulative updates first) can be used for steps 9 & 17 above. Separate calls cannot be used for steps 12 and 23.
+To install the checkpoint(s) when servicing the Windows OS (steps 9 & 12) and WinPE (steps 17 & 23), call `Add-WindowsPackage` with the target cumulative update. The folder from `-PackagePath` is used to discover and install one or more checkpoints as needed. Only the target cumulative update and checkpoint cumulative updates should be in the `-PackagePath` folder. Cumulative update packages with a revision <= the target cumulative update are processed. If you aren't customizing the image with additional languages and/or optional features, then separate calls to `Add-WindowsPackage` (checkpoint cumulative updates first) can be used for steps 9 & 17 above. Separate calls can't be used for steps 12 and 23.
## Windows PowerShell scripts to apply Dynamic Updates to an existing image
@@ -178,7 +178,7 @@ These examples are for illustration only, and therefore lack error handling. The
### Get started
-The script starts by declaring global variables and creating folders to use for mounting images. Then, make a copy of the original media, from \oldMedia to \newMedia, keeping the original media in case there's a script error and it's necessary to start over from a known state. Also, it provides a comparison of old versus new media to evaluate changes. To ensure that the new media updates, make sure they aren't read-only. The script also showcases adding additional languages, Features on Demand, and Optional Components. These are not required, but added to highlight when in the sequence they should be addeed. Starting with Windows 11, version 21H2, the language pack (LANGPACK) ISO has been superseded by the Features on Demand ISO. Language packs and the \Windows Preinstallation Environment packages are part of the Features on Demand ISO. Further, the path for main OS language and optional features moved to \LanguagesAndOptionalFeatures instead of the root. If you are using this script for Windows 10, modify to mount and use the language pack (LANGPACK) ISO.
+The script starts by declaring global variables and creating folders to use for mounting images. Then, make a copy of the original media, from \oldMedia to \newMedia, keeping the original media in case there's a script error and it's necessary to start over from a known state. Also, it provides a comparison of old versus new media to evaluate changes. To ensure that the new media updates, make sure they aren't read-only. The script also showcases adding additional languages, Features on Demand, and Optional Components. These aren't required, but added to highlight when in the sequence they should be added. Starting with Windows 11, version 21H2, the language pack (LANGPACK) ISO is superseded by the Features on Demand ISO. Language packs and the \Windows Preinstallation Environment packages are part of the Features on Demand ISO. Further, the path for main OS language and optional features moved to \LanguagesAndOptionalFeatures instead of the root. If you're using this script for Windows 10, modify to mount and use the language pack (LANGPACK) ISO.
```powershell
@@ -253,11 +253,11 @@ Get-ChildItem -Path $MEDIA_NEW_PATH -Recurse | Where-Object { -not $_.PSIsContai
### Update WinRE and each main OS Windows edition
-The script will update each edition of Windows within the main operating system file (install.wim). For each edition, the main OS image is mounted.
+The script updates each edition of Windows within the main operating system file (install.wim). For each edition, the main OS image is mounted.
-For the first image, Winre.wim is copied to the working folder, and mounted. It then applies servicing stack servicing stack via the latest cumulative update, since its components are used for updating other components. Depending on the Windows release that you are updating, there are two different approaches for updating the servicing stack. The first approach is to use the combined cumulative update. This is for Windows releases that are shipping a combined cumulative update that includes the servicing stack updates (i.e. SSU + LCU are combined). Windows 11, version 21H2 and Windows 11, version 22H2 are examples. In these cases, the servicing stack update is not published seperately; the combined cumulative update should be used for this step. However, in hopefully rare cases, there may breaking change in the combined cumulative update format change, that requires a standalone servicing stack update to be published, and installed first before the combined cumulative update can be installed. Since the script is optionally adding Japanese, it adds the language pack to the image, and installs the Japanese versions of all optional packages already installed in Winre.wim. Then, it applies the Safe OS Dynamic Update package. It finishes by cleaning and exporting the image to reduce the image size.
+For the first image, Winre.wim is copied to the working folder, and mounted. It then applies servicing stack via the latest cumulative update, since its components are used for updating other components. Depending on the Windows release that you're updating, there are two different approaches for updating the servicing stack. The first approach is to use the combined cumulative update. This is for Windows releases that are shipping a combined cumulative update that includes the servicing stack updates (that is, SSU + LCU are combined). Windows 11, version 21H2, and Windows 11, version 22H2 are examples. In these cases, the servicing stack update isn't published separately; the combined cumulative update should be used for this step. However, in rare cases, there might be a breaking change in the combined cumulative update format change, that requires a standalone servicing stack update to be published, and installed first before the combined cumulative update can be installed. Since the script is optionally adding Japanese, it adds the language pack to the image, and installs the Japanese versions of all optional packages already installed in Winre.wim. Then, it applies the Safe OS Dynamic Update package. It finishes by cleaning and exporting the image to reduce the image size.
-Next, for the mounted OS image, the script starts by applying the servicing stack via the latest cumulative update. Then, it adds Japanese language support and then the Japanese language features. Unlike the Dynamic Update packages, it uses `Add-WindowsCapability` to add these features. For a full list of such features, and their associated capability name, see [Available Features on Demand](/windows-hardware/manufacture/desktop/features-on-demand-non-language-fod). Now is the time to enable other Optional Components or add other Features on Demand. If such a feature has an associated cumulative update (for example, .NET), this is the time to apply those. The script then attempts to clean the image, then a final step to apply the latest cumulative update. It is important to apply the latest cumulative update last, to ensure Features on Demand, Optional Components and Languages are updated from their initial release state. The .NET feature is an exception, that is added along with its cumulative update next. Finally, the script exports the image.
+Next, for the mounted OS image, the script starts by applying the servicing stack via the latest cumulative update. Then, it adds Japanese language support and then the Japanese language features. Unlike the Dynamic Update packages, it uses `Add-WindowsCapability` to add these features. For a full list of such features, and their associated capability name, see [Available Features on Demand](/windows-hardware/manufacture/desktop/features-on-demand-non-language-fod). Now is the time to enable other Optional Components or add other Features on Demand. If such a feature has an associated cumulative update (for example, .NET), this is the time to apply those. The script then attempts to clean the image, then a final step to apply the latest cumulative update. It's important to apply the latest cumulative update last, to ensure Features on Demand, Optional Components, and Languages are updated from their initial release state. The .NET feature is an exception that's added along with its cumulative update next. Finally, the script exports the image.
This process is repeated for each edition of Windows within the main operating system file. To reduce size, the serviced Winre.wim file from the first image is saved, and used to update each subsequent Windows edition. This reduces the final size of install.wim.
@@ -472,7 +472,7 @@ Move-Item -Path $WORKING_PATH"\install2.wim" -Destination $MEDIA_NEW_PATH"\sourc
### Update WinPE
-This script is similar to the one that updates WinRE, but instead it mounts Boot.wim, applies the packages with the latest cumulative update last, and saves. It repeats this for all images inside of Boot.wim, typically two images. It starts by applying the servicing stack Dynamic Update. Since the script is customizing this media with Japanese, it installs the language pack from the WinPE folder on the language pack ISO. Additionally, it adds font support and text to speech (TTS) support. Since the script is adding a new language, it rebuilds lang.ini, used to identify languages installed in the image. For the second image, we'll save setup.exe and setuphost.exe for later use, to ensure these versions matches the \sources\setup.exe and \sources\setuphost.exe version from the installation media. If these binaries aren't identical, Windows Setup will fail during installation. We'll also save the serviced boot manager files for later use in the script. Finally, the script cleans and exports Boot.wim, and copies it back to the new media.
+This script is similar to the one that updates WinRE, but instead it mounts Boot.wim, applies the packages with the latest cumulative update last, and saves. It repeats this for all images inside of Boot.wim, typically two images. It starts by applying the servicing stack Dynamic Update. Since the script is customizing this media with Japanese, it installs the language pack from the WinPE folder on the language pack ISO. Additionally, it adds font support and text to speech (TTS) support. Since the script is adding a new language, it rebuilds lang.ini, used to identify languages installed in the image. For the second image, we save setup.exe and setuphost.exe for later use, to ensure these versions matches the \sources\setup.exe and \sources\setuphost.exe version from the installation media. If these binaries aren't identical, Windows Setup will fail during installation. We'll also save the serviced boot manager files for later use in the script. Finally, the script cleans and exports Boot.wim, and copies it back to the new media.
```powershell
#
@@ -613,7 +613,7 @@ Move-Item -Path $WORKING_PATH"\boot2.wim" -Destination $MEDIA_NEW_PATH"\sources\
### Update remaining media files
-This part of the script updates the Setup files. It simply copies the individual files in the Setup Dynamic Update package to the new media. This step brings in updated Setup files as needed, along with the latest compatibility database, and replacement component manifests. This script also does a final replacement of setup.exe, setuphost.exe and boot manager files using the previously saved versions from WinPE.
+This part of the script updates the Setup files. It simply copies the individual files in the Setup Dynamic Update package to the new media. This step brings in updated Setup files as needed, along with the latest compatibility database, and replacement component manifests. This script also does a final replacement of setup.exe, setuphost.exe, and boot manager files using the previously saved versions from WinPE.
```powershell
#
From 91177ed30463896996a7bdce6ceae640d31e4f46 Mon Sep 17 00:00:00 2001
From: tiaraquan
Date: Mon, 3 Feb 2025 10:15:42 -0800
Subject: [PATCH 51/86] Updates to hotpatch content
---
.../windows-autopatch-hotpatch-updates.md | 33 +++++++++++++------
1 file changed, 23 insertions(+), 10 deletions(-)
diff --git a/windows/deployment/windows-autopatch/manage/windows-autopatch-hotpatch-updates.md b/windows/deployment/windows-autopatch/manage/windows-autopatch-hotpatch-updates.md
index d92f402704..5ffdbf1d92 100644
--- a/windows/deployment/windows-autopatch/manage/windows-autopatch-hotpatch-updates.md
+++ b/windows/deployment/windows-autopatch/manage/windows-autopatch-hotpatch-updates.md
@@ -1,7 +1,7 @@
---
title: Hotpatch updates
description: Use Hotpatch updates to receive security updates without restarting your device
-ms.date: 11/19/2024
+ms.date: 02/03/2025
ms.service: windows-client
ms.subservice: autopatch
ms.topic: how-to
@@ -22,7 +22,12 @@ ms.collection:
> [!IMPORTANT]
> This feature is in public preview. It's being actively developed and might not be complete. They're made available on a "Preview" basis. You can test and use these features in production environments and scenarios and provide feedback.
-Hotpatch updates are [Monthly B release security updates](/windows/deployment/update/release-cycle#monthly-security-update-release) that can be installed without requiring you to restart the device. Hotpatch updates are designed to reduce downtime and disruptions. By minimizing the need to restart, these updates help ensure faster compliance, making it easier for organizations to maintain security while keeping workflows uninterrupted.
+Hotpatch updates are designed to reduce downtime and disruptions. Hotpatch updates are [Monthly B release security updates](/windows/deployment/update/release-cycle#monthly-security-update-release) that install and take effect without requiring you to restart the device. By minimizing the need to restart, these updates help ensure faster compliance, making it easier for organizations to maintain security while keeping workflows uninterrupted.
+
+Hotpatch is an extension of Windows Update and requires Autopatch to create and deploy hotpatches to devices enrolled in the Autopatch quality update policy.
+
+> [!NOTE]
+> Hotpatch is also available on Windows Server and Windows 365. For more information, see [Hotpatch for Windows Server Azure Edition](/windows-server/get-started/enable-hotpatch-azure-edition).
## Key benefits
@@ -30,7 +35,18 @@ Hotpatch updates are [Monthly B release security updates](/windows/deployment/up
- No changes are required to your existing update ring configurations. Your existing ring configurations are honored alongside Hotpatch policies.
- The [Hotpatch quality update report](../monitor/windows-autopatch-hotpatch-quality-update-report.md) provides a per policy level view of the current update statuses for all devices that receive Hotpatch updates.
-## Operating system configuration prerequisites
+## Release cycles
+
+For more information about the release calendar for Hotpatch updates, see [Release notes for Hotpatch](https://support.microsoft.com/topic/release-notes-for-hotpatch-in-azure-automanage-for-windows-server-2022-4e234525-5bd5-4171-9886-b475dabe0ce8?preview=true).
+
+| Quarter | Baseline updates (requires restart) | Hotpatch (no restart required) |
+| ----- | ----- | ----- |
+| 1 | January | February and March |
+| 2 | April | May and June |
+| 3 | July | August and September |
+| 4 | October | November and December |
+
+## Operating system configuration prerequisites
To prepare a device to receive Hotpatch updates, configure the following operating system settings on the device. You must configure these settings for the device to be offered the Hotpatch update and to apply all Hotpatch updates.
@@ -66,13 +82,6 @@ LCUs requires you to restart the device, but the LCU ensures that the device rem
> [!NOTE]
> If devices aren't eligible for Hotpatch updates, these devices are offered the LCU. The LCU keeps your configured Update ring settings, it doesn't change the settings.
-## Release cycles
-
-For more information about the release calendar for Hotpatch updates, see [Release notes for Hotpatch](https://support.microsoft.com/topic/release-notes-for-hotpatch-in-azure-automanage-for-windows-server-2022-4e234525-5bd5-4171-9886-b475dabe0ce8?preview=true).
-
-- Baseline Release Months: January, April, July, October
-- Hotpatch Release Months: February, March, May, June, August, September, November, December
-
## Enroll devices to receive Hotpatch updates
> [!NOTE]
@@ -95,3 +104,7 @@ These steps ensure that targeted devices, which are [eligible](#eligible-devices
> [!NOTE]
> Turning on Hotpatch updates doesn't change the existing deadline-driven or scheduled install configurations on your managed devices. Deferral and active hour settings still apply.
+
+## Roll back a hotpatch update
+
+Automatic rollback of a Hotpatch update isn’t supported but you can uninstall them. If you experience an unexpected issue with hotpatch updates, you can investigate by uninstalling the hotpatch update and installing the latest standard cumulative update (LCU) and restart. Uninstalling a hotpatch update is quick, however, it does require a device restart.
From 037fc0d57108936d6df0f429ec0db30fd8e26663 Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Mon, 3 Feb 2025 11:58:44 -0800
Subject: [PATCH 52/86] dep-bloglink-and-edits
---
windows/whats-new/deprecated-features.md | 18 +++++++++---------
1 file changed, 9 insertions(+), 9 deletions(-)
diff --git a/windows/whats-new/deprecated-features.md b/windows/whats-new/deprecated-features.md
index 4b2f886e48..f18324df51 100644
--- a/windows/whats-new/deprecated-features.md
+++ b/windows/whats-new/deprecated-features.md
@@ -1,7 +1,7 @@
---
title: Deprecated features in the Windows client
description: Review the list of features that Microsoft is no longer actively developing in Windows 10 and Windows 11.
-ms.date: 01/24/2025
+ms.date: 02/03/2025
ms.service: windows-client
ms.subservice: itpro-fundamentals
ms.localizationpriority: medium
@@ -21,9 +21,9 @@ appliesto:
Each version of Windows client adds new features and functionality. Occasionally, new versions also remove features and functionality, often because they added a newer option. This article provides details about the features and functionalities that are no longer being developed in Windows client. For more information about features that were removed, see [Windows features removed](removed-features.md).
-For more information about features in Windows 11, see [Feature deprecations and removals](https://www.microsoft.com/windows/windows-11-specifications#table3).
-
-To understand the distinction between *deprecation* and *removal*, see [Windows client features lifecycle](feature-lifecycle.md).
+- To understand the distinction between *deprecation* and *removal*, see [Windows client features lifecycle](feature-lifecycle.md).
+- For more information about how deprecation fits into the Windows lifecycle, see [Deprecation: What it means in the Windows lifecycle](https://techcommunity.microsoft.com/blog/windows-itpro-blog/deprecation-what-it-means-in-the-windows-lifecycle/4372457).
+- For more information about features removed on upgrade to Windows 11 from Windows 10, see [Feature deprecations and removals](https://www.microsoft.com/windows/windows-11-specifications#table3).
The features in this article are no longer being actively developed, and might be removed in a future update. Some features were replaced with other features or functionality and some are now available from other sources.
@@ -50,15 +50,15 @@ The features in this article are no longer being actively developed, and might b
| Suggested actions | Suggested actions that appear when you copy a phone number or future date in Windows 11 are deprecated and will be removed in a future Windows 11 update. | December 2024 |
| Legacy DRM services | Legacy DRM services, used by either Windows Media Player, Silverlight clients, Windows 7, or Windows 8 clients are deprecated. The following functionality won't work when these services are fully retired: - Playback of protected content in the legacy Windows Media Player on Windows 7
- Playback of protected content in a Silverlight client and Windows 8 clients
- In-home streaming playback from a Silverlight client or Windows 8 client to an Xbox 360
- Playback of protected content ripped from a personal CD on Windows 7 clients using Windows Media Player
| September 2024 |
| Paint 3D | Paint 3D is deprecated and will be removed from the Microsoft Store on November 4, 2024. To view and edit 2D images, you can use [Paint](https://apps.microsoft.com/detail/9pcfs5b6t72h) or [Photos](https://apps.microsoft.com/detail/9wzdncrfjbh4). For viewing 3D content, you can use [3D Viewer](https://apps.microsoft.com/detail/9nblggh42ths). For more information, see [Resources for deprecated features](deprecated-features-resources.md#paint-3d). | August 2024 |
-| Adobe Type1 fonts | Adobe PostScript Type1 fonts are deprecated and support will be removed in a future release of Windows. In January 2023, Adobe announced the [end of support for PostScript Type1 fonts](https://helpx.adobe.com/fonts/kb/postscript-type-1-fonts-end-of-support.html) for their latest software offerings. Remove any dependencies on this font type by selecting a supported font type. To display currently installed fonts, go to **Settings** > **Personalization** > **Fonts**. Application developers and content owners should test their apps and data files with the Adobe Type1 fonts removed. For more information, contact the application vendor or Adobe. | August 2024 |
+| Adobe Type1 fonts | Adobe PostScript Type1 fonts are deprecated and support will be removed in a future release of Windows. In January 2023, Adobe announced the [end of support for PostScript Type1 fonts](https://helpx.adobe.com/fonts/kb/postscript-type-1-fonts-end-of-support.html) for their latest software offerings. Remove any dependencies on this font type by selecting a supported font type. To display currently installed fonts, go to **Settings** > **Personalization** > **Fonts**. Application developers and content owners should test their apps and data files with the Adobe Type1 fonts removed. For more information, contact the application vendor or Adobe. | August 2024 |
| DirectAccess | DirectAccess is deprecated and will be removed in a future release of Windows. We recommend [migrating from DirectAccess to Always On VPN](/windows-server/remote/remote-access/da-always-on-vpn-migration/da-always-on-migration-overview). | June 2024 |
-| NTLM | All versions of [NTLM](/windows/win32/secauthn/microsoft-ntlm), including LANMAN, NTLMv1, and NTLMv2, are no longer under active feature development and are deprecated. Use of NTLM will continue to work in the next release of Windows Server and the next annual release of Windows. Calls to NTLM should be replaced by calls to Negotiate, which will try to authenticate with Kerberos and only fall back to NTLM when necessary. For more information, see, [Resources for deprecated features](deprecated-features-resources.md). **[Update - November 2024]**: NTLMv1 is [removed](removed-features.md) starting in Windows 11, version 24H2 and Windows Server 2025. | June 2024 |
+| NTLM | All versions of [NTLM](/windows/win32/secauthn/microsoft-ntlm), including LANMAN, NTLMv1, and NTLMv2, are no longer under active feature development and are deprecated. Use of NTLM will continue to work in the next release of Windows Server and the next annual release of Windows. Calls to NTLM should be replaced by calls to Negotiate, which tries to authenticate with Kerberos and only falls back to NTLM when necessary. For more information, see, [Resources for deprecated features](deprecated-features-resources.md). **[Update - November 2024]**: NTLMv1 is [removed](removed-features.md) starting in Windows 11, version 24H2 and Windows Server 2025. | June 2024 |
| Driver Verifier GUI (verifiergui.exe) | Driver Verifier GUI, verifiergui.exe, is deprecated and will be removed in a future version of Windows. You can use the [Verifier Command Line](/windows-hardware/drivers/devtest/verifier-command-line) (verifier.exe) instead of the Driver Verifier GUI.| May 2024 |
-| NPLogonNotify and NPPasswordChangeNotify APIs | Starting in Windows 11, version 24H2, the inclusion of password payload in MPR notifications is set to disabled by default through group policy in [NPLogonNotify](/windows/win32/api/npapi/nf-npapi-nplogonnotify) and [NPPasswordChangeNotify](/windows/win32/api/npapi/nf-npapi-nppasswordchangenotify) APIs. The APIs may be removed in a future release. The primary reason for disabling this feature is to enhance security. When enabled, these APIs allow the caller to retrieve a user's password, presenting potential risks for password exposure and harvesting by malicious users. To include password payload in MPR notifications, set the [EnableMPRNotifications](/windows/client-management/mdm/policy-csp-windowslogon#enablemprnotifications) policy to `enabled`.| March 2024 |
-| TLS server authentication certificates using RSA keys with key lengths shorter than 2048 bits | Support for certificates using RSA keys with key lengths shorter than 2048 bits will be deprecated. Internet standards and regulatory bodies disallowed the use of 1024-bit keys in 2013, recommending specifically that RSA keys should have a key length of 2048 bits or longer. For more information, see [Transitioning of Cryptographic Algorithms and Key Sizes - Discussion Paper (nist.gov)](https://csrc.nist.gov/CSRC/media/Projects/Key-Management/documents/transitions/Transitioning_CryptoAlgos_070209.pdf). This deprecation focuses on ensuring that all RSA certificates used for TLS server authentication must have key lengths greater than or equal to 2048 bits to be considered valid by Windows. TLS certificates issued by enterprise or test certification authorities (CA) aren't impacted with this change. However, we recommend that they be updated to RSA keys greater than or equal to 2048 bits as a security best practice. This change is necessary to preserve security of Windows customers using certificates for authentication and cryptographic purposes.| March 2024|
+| NPLogonNotify and NPPasswordChangeNotify APIs | Starting in Windows 11, version 24H2, the inclusion of password payload in MPR notifications is set to `disabled` by default through group policy in [NPLogonNotify](/windows/win32/api/npapi/nf-npapi-nplogonnotify) and [NPPasswordChangeNotify](/windows/win32/api/npapi/nf-npapi-nppasswordchangenotify) APIs. The APIs may be removed in a future release. The primary reason for disabling this feature is to enhance security. When enabled, these APIs allow the caller to retrieve a user's password, presenting potential risks for password exposure and harvesting by malicious users. To include password payload in MPR notifications, set the [EnableMPRNotifications](/windows/client-management/mdm/policy-csp-windowslogon#enablemprnotifications) policy to `enabled`.| March 2024 |
+| TLS server authentication certificates using RSA keys with key lengths shorter than 2048 bits | Support for certificates using RSA keys with key lengths shorter than 2048 bits is deprecated. Internet standards and regulatory bodies disallowed the use of 1024-bit keys in 2013, recommending specifically that RSA keys should have a key length of 2048 bits or longer. For more information, see [Transitioning of Cryptographic Algorithms and Key Sizes - Discussion Paper (nist.gov)](https://csrc.nist.gov/CSRC/media/Projects/Key-Management/documents/transitions/Transitioning_CryptoAlgos_070209.pdf). This deprecation focuses on ensuring that all RSA certificates used for TLS server authentication must have key lengths greater than or equal to 2048 bits to be considered valid by Windows. TLS certificates issued by enterprise or test certification authorities (CA) aren't impacted with this change. However, we recommend that they be updated to RSA keys greater than or equal to 2048 bits as a security best practice. This change is necessary to preserve security of Windows customers using certificates for authentication and cryptographic purposes.| March 2024|
| Test Base | [Test Base for Microsoft 365](/microsoft-365/test-base/overview), an Azure cloud service for application testing, is deprecated. The service will be retired in the future and will be no longer available for use after retirement. | March 2024 |
| Windows Mixed Reality | [Windows Mixed Reality](/windows/mixed-reality/enthusiast-guide/before-you-start) is deprecated and will be removed in Windows 11, version 24H2. This deprecation includes the [Mixed Reality Portal](/windows/mixed-reality/enthusiast-guide/install-windows-mixed-reality) app, [Windows Mixed Reality for SteamVR](/windows/mixed-reality/enthusiast-guide/using-steamvr-with-windows-mixed-reality), and Steam VR Beta. Existing Windows Mixed Reality devices will continue to work with Steam through November 2026, if users remain on their current released version of Windows 11, version 23H2. After November 2026, Windows Mixed Reality will no longer receive security updates, nonsecurity updates, bug fixes, technical support, or online technical content updates. | December 2023 |
-| Microsoft Defender Application Guard for Edge | [Microsoft Defender Application Guard](/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-overview), including the [Windows Isolated App Launcher APIs](/windows/win32/api/isolatedapplauncher/), is deprecated for Microsoft Edge for Business and [will no longer be updated](feature-lifecycle.md). To learn more about Edge for Business security capabilities, see [Microsoft Edge security for your business](/deployedge/ms-edge-security-for-business). **[Update - October 2024]**: Starting with Windows 11, version 24H2, Microsoft Defender Application Guard, including the [Windows Isolated App Launcher APIs](/windows/win32/api/isolatedapplauncher/), is no longer available.
**[Update - April 2024]**: Because Application Guard is deprecated there will not be a migration to Edge Manifest V3. The corresponding extensions and associated Windows Store app will not be available after May 2024. This affects the following browsers: *Application Guard Extension - Chrome* and *Application Guard Extension - Firefox*. If you want to block unprotected browsers until you are ready to retire MDAG usage in your enterprise, we recommend using AppLocker policies or [Microsoft Edge management service](/deployedge/microsoft-edge-management-service). For more information, see [Microsoft Edge and Microsoft Defender Application Guard](/deployedge/microsoft-edge-security-windows-defender-application-guard). | December 2023 |
+| Microsoft Defender Application Guard for Edge | [Microsoft Defender Application Guard](/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-overview), including the [Windows Isolated App Launcher APIs](/windows/win32/api/isolatedapplauncher/), is deprecated for Microsoft Edge for Business and [will no longer be updated](feature-lifecycle.md). To learn more about Edge for Business security capabilities, see [Microsoft Edge security for your business](/deployedge/ms-edge-security-for-business). **[Update - October 2024]**: Starting with Windows 11, version 24H2, Microsoft Defender Application Guard, including the [Windows Isolated App Launcher APIs](/windows/win32/api/isolatedapplauncher/), is no longer available.
**[Update - April 2024]**: Because Application Guard is deprecated there won't be a migration to Edge Manifest V3. The corresponding extensions and associated Windows Store app won't be available after May 2024. This change affects the following browsers: *Application Guard Extension - Chrome* and *Application Guard Extension - Firefox*. If you want to block unprotected browsers until you're ready to retire MDAG usage in your enterprise, we recommend using AppLocker policies or [Microsoft Edge management service](/deployedge/microsoft-edge-management-service). For more information, see [Microsoft Edge and Microsoft Defender Application Guard](/deployedge/microsoft-edge-security-windows-defender-application-guard). | December 2023 |
| Legacy console mode | The [legacy console mode](/windows/console/legacymode) is deprecated and no longer being updated. In future Windows releases, it will be available as an optional [Feature on Demand](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities). This feature won't be installed by default. | December 2023 |
| Windows speech recognition | [Windows speech recognition](https://support.microsoft.com/windows/83ff75bd-63eb-0b6c-18d4-6fae94050571) is deprecated and is no longer being developed. This feature is being replaced with [voice access](https://support.microsoft.com/topic/4dcd23ee-f1b9-4fd1-bacc-862ab611f55d). Voice access is available for Windows 11, version 22H2, or later devices. Currently, voice access supports five English locales: English - US, English - UK, English - India, English - New Zealand, English - Canada, and English - Australia. For more information, see [Setup voice access](https://support.microsoft.com/topic/set-up-voice-access-9fc44e29-12bf-4d86-bc4e-e9bb69df9a0e). | December 2023 |
| Microsoft Defender Application Guard for Office | [Microsoft Defender Application Guard for Office](/microsoft-365/security/office-365-security/app-guard-for-office-install), including the [Windows Isolated App Launcher APIs](/windows/win32/api/isolatedapplauncher/), is being deprecated and will no longer be updated. We recommend transitioning to Microsoft Defender for Endpoint [attack surface reduction rules](/microsoft-365/security/defender-endpoint/overview-attack-surface-reduction) along with [Protected View](/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365#global-settings-for-safe-attachments) and [Windows Defender Application Control](/windows/security/application-security/application-control/windows-defender-application-control/wdac). | November 2023 |
From 516a9e8f2d2ab5af3009f19b21a7a6a2bb05a598 Mon Sep 17 00:00:00 2001
From: Mike England
Date: Mon, 3 Feb 2025 13:12:08 -0800
Subject: [PATCH 53/86] Update windows-autopatch-configure-network.md
---
.../prepare/windows-autopatch-configure-network.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/deployment/windows-autopatch/prepare/windows-autopatch-configure-network.md b/windows/deployment/windows-autopatch/prepare/windows-autopatch-configure-network.md
index c3c115d488..7778e7edf0 100644
--- a/windows/deployment/windows-autopatch/prepare/windows-autopatch-configure-network.md
+++ b/windows/deployment/windows-autopatch/prepare/windows-autopatch-configure-network.md
@@ -63,7 +63,7 @@ The following URLs must be on the allowed list of your proxy and firewall so tha
| Microsoft service | URLs required on allowlist |
| ----- | ----- |
-| Windows Autopatch | - mmdcustomer.microsoft.com
- mmdls.microsoft.com
- logcollection.mmd.microsoft.com
- support.mmd.microsoft.com
- devicelistenerprod.microsoft.com
- login.windows.net
- device.autopatch.microsoft.com
|
+| Windows Autopatch | - mmdcustomer.microsoft.com
- mmdls.microsoft.com
- devicelistenerprod.microsoft.com
- login.windows.net
- device.autopatch.microsoft.com
|
## Delivery Optimization
From 30baf3ec6a11af515e9543487ce6b7afa873a7cd Mon Sep 17 00:00:00 2001
From: chrisjlin <36452239+chrisjlin@users.noreply.github.com>
Date: Tue, 4 Feb 2025 15:06:08 -0800
Subject: [PATCH 54/86] Add ubuntu/snapcraft endpoints
---
windows/deployment/do/delivery-optimization-endpoints.md | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/windows/deployment/do/delivery-optimization-endpoints.md b/windows/deployment/do/delivery-optimization-endpoints.md
index 79e8211757..2dfd4d8e9e 100644
--- a/windows/deployment/do/delivery-optimization-endpoints.md
+++ b/windows/deployment/do/delivery-optimization-endpoints.md
@@ -36,4 +36,5 @@ Use the table below to reference any particular content types or services endpoi
| *.assets1.xboxlive.com, *.assets2.xboxlive.com, *.dlassets.xboxlive.com, *.dlassets2.xboxlive.com, *.d1.xboxlive.com, *.d2.xboxlive.com, *.assets.xbox.com, *.xbl-dlassets-origin.xboxlive.com, *.assets-origin.xboxlive.com, *.xvcb1.xboxlive.com, *.xvcb2.xboxlive.com, *.xvcf1.xboxlive.com, *.xvcf2.xboxlive.com | HTTP / 80 | Xbox | | Both |
| *.tlu.dl.adu.microsoft.com, *.nlu.dl.adu.microsoft.com, *.dcsfe.prod.adu.microsoft.com | HTTP / 80 | Device Update | [Complete list](/azure/iot-hub-device-update/) of endpoints for Device Update updates. | Both |
| *.do.dsp.mp.microsoft.com | HTTP / 80 HTTPs / 443 | Microsoft Connected Cache -> Delivery Optimization Services communication | [Complete list](../do/waas-delivery-optimization-faq.yml) of endpoints for Delivery Optimization only. | Connected Cache Managed in Azure |
-| *.azure-devices.net, *.global.azure-devices-provisioning.net, *.azurecr.io, *.blob.core.windows.net, *.mcr.microsoft.com, github.com | AMQP / 5671 MQTT / 8883 HTTPs / 443 | IoT Edge / IoT Hub communication| [Complete list](/azure/iot-hub/iot-hub-devguide-protocols) of Azure IoT Hub communication protocols and ports. [Azure IoT Guide](/azure/iot-hub/iot-hub-devguide-endpoints) to understanding Azure IoT Hub endpoints. | Connected Cache Managed in Azure |
+| *.azure-devices.net, *.global.azure-devices-provisioning.net, *.azurecr.io, *.blob.core.windows.net, *.mcr.microsoft.com, github.com | HTTPs / 443 | IoT Edge / IoT Hub communication| [Complete list](/azure/iot-hub/iot-hub-devguide-protocols) of Azure IoT Hub communication protocols and ports. [Azure IoT Guide](/azure/iot-hub/iot-hub-devguide-endpoints) to understanding Azure IoT Hub endpoints. | Connected Cache Managed in Azure |
+| *.ubuntu.com, api.snapcraft.io | HTTP / 80 HTTPs / 443 | Ubuntu package updates | Used to deploy Connected Cache to Windows host machines. | Connected Cache Managed in Azure |
From 287ff269718ba555310d8a1b02277d7305e44cf5 Mon Sep 17 00:00:00 2001
From: chrisjlin <36452239+chrisjlin@users.noreply.github.com>
Date: Tue, 4 Feb 2025 15:07:12 -0800
Subject: [PATCH 55/86] Update known issues page
---
windows/deployment/do/mcc-ent-troubleshooting.md | 2 --
1 file changed, 2 deletions(-)
diff --git a/windows/deployment/do/mcc-ent-troubleshooting.md b/windows/deployment/do/mcc-ent-troubleshooting.md
index 9e896b0acf..a602264680 100644
--- a/windows/deployment/do/mcc-ent-troubleshooting.md
+++ b/windows/deployment/do/mcc-ent-troubleshooting.md
@@ -23,8 +23,6 @@ This article contains instructions on how to troubleshoot different issues you m
This section describes known issues with the latest release of Microsoft Connected Cache for Enterprise and Education. See the [Release Notes page](mcc-ent-release-notes.md) for more details on the fixes included in the latest release.
-### Cache node monitoring chart in the Azure portal user interface displays incorrect information
-
### Script provisionmcconwsl.ps1 fails when executed on a Windows 11 host machine configured to use Japanese language
In the Connected Cache installation script (provisionmcconwsl.ps1), the check processing is executed until the value of the last execution code (Last Result) of the installation task becomes 0 in the following processing. However, in Japanese OS, the return value is null because "Last Result" is displayed, and an exception occurs.
From ebf63cf1df4fe46e1b0e8a302ce784de04055efb Mon Sep 17 00:00:00 2001
From: chrisjlin <36452239+chrisjlin@users.noreply.github.com>
Date: Tue, 4 Feb 2025 15:09:39 -0800
Subject: [PATCH 56/86] Added packages.microsoft.com to endpoints
---
windows/deployment/do/delivery-optimization-endpoints.md | 1 +
1 file changed, 1 insertion(+)
diff --git a/windows/deployment/do/delivery-optimization-endpoints.md b/windows/deployment/do/delivery-optimization-endpoints.md
index 2dfd4d8e9e..3bc2a48d9b 100644
--- a/windows/deployment/do/delivery-optimization-endpoints.md
+++ b/windows/deployment/do/delivery-optimization-endpoints.md
@@ -38,3 +38,4 @@ Use the table below to reference any particular content types or services endpoi
| *.do.dsp.mp.microsoft.com | HTTP / 80 HTTPs / 443 | Microsoft Connected Cache -> Delivery Optimization Services communication | [Complete list](../do/waas-delivery-optimization-faq.yml) of endpoints for Delivery Optimization only. | Connected Cache Managed in Azure |
| *.azure-devices.net, *.global.azure-devices-provisioning.net, *.azurecr.io, *.blob.core.windows.net, *.mcr.microsoft.com, github.com | HTTPs / 443 | IoT Edge / IoT Hub communication| [Complete list](/azure/iot-hub/iot-hub-devguide-protocols) of Azure IoT Hub communication protocols and ports. [Azure IoT Guide](/azure/iot-hub/iot-hub-devguide-endpoints) to understanding Azure IoT Hub endpoints. | Connected Cache Managed in Azure |
| *.ubuntu.com, api.snapcraft.io | HTTP / 80 HTTPs / 443 | Ubuntu package updates | Used to deploy Connected Cache to Windows host machines. | Connected Cache Managed in Azure |
+| packages.microsoft.com | HTTP / 80 HTTPs / 443 | Microsoft package updates | Used to deploy Connected Cache to Windows and Linux host machines. | Connected Cache Managed in Azure |
From 2dae80083b8cb477138cb63c923ab70a64868bb2 Mon Sep 17 00:00:00 2001
From: chrisjlin <36452239+chrisjlin@users.noreply.github.com>
Date: Tue, 4 Feb 2025 15:21:07 -0800
Subject: [PATCH 57/86] Install script v2.0.0.2 release notes
---
windows/deployment/do/mcc-ent-release-notes.md | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/windows/deployment/do/mcc-ent-release-notes.md b/windows/deployment/do/mcc-ent-release-notes.md
index 28471a7fb7..4f9a0b4e30 100644
--- a/windows/deployment/do/mcc-ent-release-notes.md
+++ b/windows/deployment/do/mcc-ent-release-notes.md
@@ -18,6 +18,18 @@ ms.date: 10/30/2024
This article contains details about the latest releases of Connected Cache. Since Connected Cache is a preview service, some releases may contain breaking changes.
+## Install script v2.0.0.2
+
+Released on **2/5/2025**
+
+These changes only affect the installation scripts for Connected Cache. To take advantage of these changes, you will need to re-deploy your existing cache nodes using the updated installation script.
+
+### Feature updates
+
+- **Removes dependency on AMQP/MQTT ports**: Cache nodes deployed using this updated installation script will no longer use AMQP (5671) or MQTT (8883) ports. This change simplifies the network configuration for cache nodes and reduces the number of ports that need to be opened in your network security group.
+- **Improves cleanup during uninstall**: Windows-hosted cache nodes will now remove port proxy rules when uninstalled using the `uninstallmcconwsl.ps1` script. This change ensures that the host machine's WSL port-forwarding rules are cleaned up properly when uninstalling Connected Cache.
+- **Changes install error codes from decimal to hex code**: Install error codes for Windows-hosted cache nodes are now displayed in hex code format, improving error code readability.
+
## Release v1.2.1.2076_E (public preview launch)
The public preview released on **10/30/2024**
From 85227fc618327c3432aba237d7a000a8e1948e38 Mon Sep 17 00:00:00 2001
From: chrisjlin <36452239+chrisjlin@users.noreply.github.com>
Date: Tue, 4 Feb 2025 15:35:06 -0800
Subject: [PATCH 58/86] Retitle feature updates to improvements in release
notes
---
windows/deployment/do/mcc-ent-release-notes.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/deployment/do/mcc-ent-release-notes.md b/windows/deployment/do/mcc-ent-release-notes.md
index 4f9a0b4e30..fb5b1e5eb5 100644
--- a/windows/deployment/do/mcc-ent-release-notes.md
+++ b/windows/deployment/do/mcc-ent-release-notes.md
@@ -24,7 +24,7 @@ Released on **2/5/2025**
These changes only affect the installation scripts for Connected Cache. To take advantage of these changes, you will need to re-deploy your existing cache nodes using the updated installation script.
-### Feature updates
+### Improvements
- **Removes dependency on AMQP/MQTT ports**: Cache nodes deployed using this updated installation script will no longer use AMQP (5671) or MQTT (8883) ports. This change simplifies the network configuration for cache nodes and reduces the number of ports that need to be opened in your network security group.
- **Improves cleanup during uninstall**: Windows-hosted cache nodes will now remove port proxy rules when uninstalled using the `uninstallmcconwsl.ps1` script. This change ensures that the host machine's WSL port-forwarding rules are cleaned up properly when uninstalling Connected Cache.
From 2f3ae7ec767dfa988aa59ff411c3c196822aaca3 Mon Sep 17 00:00:00 2001
From: chrisjlin <36452239+chrisjlin@users.noreply.github.com>
Date: Wed, 5 Feb 2025 09:40:54 -0800
Subject: [PATCH 59/86] Add proxy install to release notes
---
windows/deployment/do/mcc-ent-release-notes.md | 1 +
1 file changed, 1 insertion(+)
diff --git a/windows/deployment/do/mcc-ent-release-notes.md b/windows/deployment/do/mcc-ent-release-notes.md
index fb5b1e5eb5..b866870600 100644
--- a/windows/deployment/do/mcc-ent-release-notes.md
+++ b/windows/deployment/do/mcc-ent-release-notes.md
@@ -29,6 +29,7 @@ These changes only affect the installation scripts for Connected Cache. To take
- **Removes dependency on AMQP/MQTT ports**: Cache nodes deployed using this updated installation script will no longer use AMQP (5671) or MQTT (8883) ports. This change simplifies the network configuration for cache nodes and reduces the number of ports that need to be opened in your network security group.
- **Improves cleanup during uninstall**: Windows-hosted cache nodes will now remove port proxy rules when uninstalled using the `uninstallmcconwsl.ps1` script. This change ensures that the host machine's WSL port-forwarding rules are cleaned up properly when uninstalling Connected Cache.
- **Changes install error codes from decimal to hex code**: Install error codes for Windows-hosted cache nodes are now displayed in hex code format, improving error code readability.
+- **Uses proxy to perform install if configured**: If proxy is enabled in its configuration, the Windows-hosted cache node will use the configured proxy host name during installation.
## Release v1.2.1.2076_E (public preview launch)
From ace00ab40695563af94a34f3df091235362f4014 Mon Sep 17 00:00:00 2001
From: chrisjlin <36452239+chrisjlin@users.noreply.github.com>
Date: Thu, 6 Feb 2025 11:28:27 -0800
Subject: [PATCH 60/86] revise proxy wording on release notes
---
windows/deployment/do/mcc-ent-release-notes.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/deployment/do/mcc-ent-release-notes.md b/windows/deployment/do/mcc-ent-release-notes.md
index b866870600..8596a20961 100644
--- a/windows/deployment/do/mcc-ent-release-notes.md
+++ b/windows/deployment/do/mcc-ent-release-notes.md
@@ -29,7 +29,7 @@ These changes only affect the installation scripts for Connected Cache. To take
- **Removes dependency on AMQP/MQTT ports**: Cache nodes deployed using this updated installation script will no longer use AMQP (5671) or MQTT (8883) ports. This change simplifies the network configuration for cache nodes and reduces the number of ports that need to be opened in your network security group.
- **Improves cleanup during uninstall**: Windows-hosted cache nodes will now remove port proxy rules when uninstalled using the `uninstallmcconwsl.ps1` script. This change ensures that the host machine's WSL port-forwarding rules are cleaned up properly when uninstalling Connected Cache.
- **Changes install error codes from decimal to hex code**: Install error codes for Windows-hosted cache nodes are now displayed in hex code format, improving error code readability.
-- **Uses proxy to perform install if configured**: If proxy is enabled in its configuration, the Windows-hosted cache node will use the configured proxy host name during installation.
+- **Uses configured proxy to perform install**: If a proxy was configured for the Windows-hosted cache node in Azure Portal, the cache node will use the specified proxy during installation.
## Release v1.2.1.2076_E (public preview launch)
From 837625d0c9c123687bda525191b04c5bfa34ca46 Mon Sep 17 00:00:00 2001
From: chrisjlin <36452239+chrisjlin@users.noreply.github.com>
Date: Thu, 6 Feb 2025 11:34:15 -0800
Subject: [PATCH 61/86] Added note to prereqs about connection limit
---
windows/deployment/do/mcc-ent-prerequisites.md | 2 ++
1 file changed, 2 insertions(+)
diff --git a/windows/deployment/do/mcc-ent-prerequisites.md b/windows/deployment/do/mcc-ent-prerequisites.md
index f30f503e31..f8ddaef129 100644
--- a/windows/deployment/do/mcc-ent-prerequisites.md
+++ b/windows/deployment/do/mcc-ent-prerequisites.md
@@ -30,6 +30,8 @@ This article details the requirements and recommended specifications for using M
- [Windows Enterprise E3 or E5](/windows/whats-new/windows-licensing#windows-11-enterprise), included in [Microsoft 365 F3, E3, or E5](https://www.microsoft.com/microsoft-365/enterprise/microsoft365-plans-and-pricing?msockid=32c407b43d5968050f2b13443c746916)
- Windows Education A3 or A5, included in [Microsoft 365 A3 or A5](https://www.microsoft.com/education/products/microsoft-365?msockid=32c407b43d5968050f2b13443c746916#Education-plans)
+ Note that there is no limit to the number of licensed machines that may concurrently download from a Connected Cache node.
+
## Cache node host machine requirements
### General requirements
From cf039a5a2ecd3379bc3f407a295b00d2d2a8caba Mon Sep 17 00:00:00 2001
From: chrisjlin <36452239+chrisjlin@users.noreply.github.com>
Date: Thu, 6 Feb 2025 11:50:29 -0800
Subject: [PATCH 62/86] Adding GPO guidance to troubleshooting
---
windows/deployment/do/mcc-ent-troubleshooting.md | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/windows/deployment/do/mcc-ent-troubleshooting.md b/windows/deployment/do/mcc-ent-troubleshooting.md
index a602264680..ac07cde399 100644
--- a/windows/deployment/do/mcc-ent-troubleshooting.md
+++ b/windows/deployment/do/mcc-ent-troubleshooting.md
@@ -80,6 +80,10 @@ You can expect to see the following types of log files:
1. **WSL_Mcc_UserUninstall_Transcript**: This log file records the output of the "uninstallmcconwsl.ps1" script that the user can run to uninstall MCC software from the host machine.
1. **WSL_Mcc_Uninstall_FromRegisteredTask_Transcript**: This log file records the output of the "MCC_Uninstall_Task" scheduled task that is responsible for uninstalling the MCC software from the host machine when called by the "uninstallmcconwsl.ps1" script.
+### Group Policy Object conflicts with Scheduled Task registration
+
+Enabling the Group Policy Object: ["Network access: Do not allow storage of passwords and credentials for network authentication"](https://learn.microsoft.com/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication) will prevent the Connected Cache software from registering the scheduled tasks necessary for successful cache node registration and operation.
+
### WSL2 fails to install with message "A specified logon session doesn't exist"
If you're encountering this failure message when attempting to run the PowerShell command `wsl.exe --install --no-distribution` on your Windows host machine, verify that you're logged on as a local administrator and running the command from an elevated PowerShell window.
From de7a95e0c6aca58f5e465b0008b2b1dccbcfd18b Mon Sep 17 00:00:00 2001
From: chrisjlin <36452239+chrisjlin@users.noreply.github.com>
Date: Thu, 6 Feb 2025 11:55:17 -0800
Subject: [PATCH 63/86] Revise language for ubuntu endpoint
---
windows/deployment/do/delivery-optimization-endpoints.md | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/windows/deployment/do/delivery-optimization-endpoints.md b/windows/deployment/do/delivery-optimization-endpoints.md
index 3bc2a48d9b..1f8366e62b 100644
--- a/windows/deployment/do/delivery-optimization-endpoints.md
+++ b/windows/deployment/do/delivery-optimization-endpoints.md
@@ -37,5 +37,5 @@ Use the table below to reference any particular content types or services endpoi
| *.tlu.dl.adu.microsoft.com, *.nlu.dl.adu.microsoft.com, *.dcsfe.prod.adu.microsoft.com | HTTP / 80 | Device Update | [Complete list](/azure/iot-hub-device-update/) of endpoints for Device Update updates. | Both |
| *.do.dsp.mp.microsoft.com | HTTP / 80 HTTPs / 443 | Microsoft Connected Cache -> Delivery Optimization Services communication | [Complete list](../do/waas-delivery-optimization-faq.yml) of endpoints for Delivery Optimization only. | Connected Cache Managed in Azure |
| *.azure-devices.net, *.global.azure-devices-provisioning.net, *.azurecr.io, *.blob.core.windows.net, *.mcr.microsoft.com, github.com | HTTPs / 443 | IoT Edge / IoT Hub communication| [Complete list](/azure/iot-hub/iot-hub-devguide-protocols) of Azure IoT Hub communication protocols and ports. [Azure IoT Guide](/azure/iot-hub/iot-hub-devguide-endpoints) to understanding Azure IoT Hub endpoints. | Connected Cache Managed in Azure |
-| *.ubuntu.com, api.snapcraft.io | HTTP / 80 HTTPs / 443 | Ubuntu package updates | Used to deploy Connected Cache to Windows host machines. | Connected Cache Managed in Azure |
-| packages.microsoft.com | HTTP / 80 HTTPs / 443 | Microsoft package updates | Used to deploy Connected Cache to Windows and Linux host machines. | Connected Cache Managed in Azure |
+| *.ubuntu.com, api.snapcraft.io | HTTP / 80 HTTPs / 443 | Ubuntu package updates | Used by Linux distribution image in WSL on Windows host machine to deploy Connected Cache. | Connected Cache Managed in Azure |
+| packages.microsoft.com | HTTP / 80 HTTPs / 443 | Microsoft package updates | Used to deploy required Connected Cache packages to Windows and Linux host machines. | Connected Cache Managed in Azure |
From e5ed38e6621f15383c35d7269d02f3c2702b8f26 Mon Sep 17 00:00:00 2001
From: chrisjlin <36452239+chrisjlin@users.noreply.github.com>
Date: Thu, 6 Feb 2025 11:57:09 -0800
Subject: [PATCH 64/86] Acrolinx fixes to release notes
---
windows/deployment/do/mcc-ent-release-notes.md | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/windows/deployment/do/mcc-ent-release-notes.md b/windows/deployment/do/mcc-ent-release-notes.md
index 8596a20961..7a69747aff 100644
--- a/windows/deployment/do/mcc-ent-release-notes.md
+++ b/windows/deployment/do/mcc-ent-release-notes.md
@@ -20,27 +20,27 @@ This article contains details about the latest releases of Connected Cache. Sinc
## Install script v2.0.0.2
-Released on **2/5/2025**
+Released on **2/7/2025**
-These changes only affect the installation scripts for Connected Cache. To take advantage of these changes, you will need to re-deploy your existing cache nodes using the updated installation script.
+These changes only affect the installation scripts for Connected Cache. To take advantage of these changes, you'll need to redeploy your existing cache nodes using the updated installation script.
### Improvements
- **Removes dependency on AMQP/MQTT ports**: Cache nodes deployed using this updated installation script will no longer use AMQP (5671) or MQTT (8883) ports. This change simplifies the network configuration for cache nodes and reduces the number of ports that need to be opened in your network security group.
- **Improves cleanup during uninstall**: Windows-hosted cache nodes will now remove port proxy rules when uninstalled using the `uninstallmcconwsl.ps1` script. This change ensures that the host machine's WSL port-forwarding rules are cleaned up properly when uninstalling Connected Cache.
- **Changes install error codes from decimal to hex code**: Install error codes for Windows-hosted cache nodes are now displayed in hex code format, improving error code readability.
-- **Uses configured proxy to perform install**: If a proxy was configured for the Windows-hosted cache node in Azure Portal, the cache node will use the specified proxy during installation.
+- **Uses configured proxy to perform install**: If a proxy was configured for the Windows-hosted cache node in Azure portal, the cache node uses the specified proxy during installation.
## Release v1.2.1.2076_E (public preview launch)
The public preview released on **10/30/2024**
-For customers that installed earlier versions of Connected Cache, this release contains breaking changes that affect both Linux and Windows host machines. Please see the [early preview documentation page](mcc-ent-early-preview.md) for more details.
+For customers that installed earlier versions of Connected Cache, this release contains breaking changes that affect both Linux and Windows host machines. See the [early preview documentation page](mcc-ent-early-preview.md) for more details.
### Feature updates
- **Metrics and charts in Azure portal**: You can now visualize *Outbound egress* and *Volume by Content type* charts for your cache node on Azure portal. You can also create custom monitoring charts for your cache nodes. This capability is under the **Metrics** tab on Azure portal.
-- **Cache nodes for Windows or Linux host machines**: Cache nodes can now be created and deployed to Windows host machine or Linux host machines by simply choosing the OS when creating cache nodes.
+- **Cache nodes for Windows or Linux host machines**: Cache nodes can now be created and deployed to Windows host machine or Linux host machines by choosing the OS when creating cache nodes.
- **Ubuntu 22.04 LTS**: Cache nodes can now be deployed on Ubuntu 22.04 LTS.
- **Azure CLI support**: Cache nodes can now be created and managed via Azure CLI.
- **Proxy**: We added support for unauthenticated proxy and cloud proxy integration.
From dc623da946946d931abc79fa25f554f3186f7c38 Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Thu, 6 Feb 2025 12:05:12 -0800
Subject: [PATCH 65/86] Update windows/deployment/do/mcc-ent-troubleshooting.md
fix link
---
windows/deployment/do/mcc-ent-troubleshooting.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/deployment/do/mcc-ent-troubleshooting.md b/windows/deployment/do/mcc-ent-troubleshooting.md
index ac07cde399..fd4a693300 100644
--- a/windows/deployment/do/mcc-ent-troubleshooting.md
+++ b/windows/deployment/do/mcc-ent-troubleshooting.md
@@ -82,7 +82,7 @@ You can expect to see the following types of log files:
### Group Policy Object conflicts with Scheduled Task registration
-Enabling the Group Policy Object: ["Network access: Do not allow storage of passwords and credentials for network authentication"](https://learn.microsoft.com/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication) will prevent the Connected Cache software from registering the scheduled tasks necessary for successful cache node registration and operation.
+Enabling the Group Policy Object: [Network access: Do not allow storage of passwords and credentials for network authentication](/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication) will prevent the Connected Cache software from registering the scheduled tasks necessary for successful cache node registration and operation.
### WSL2 fails to install with message "A specified logon session doesn't exist"
From caf9f1dd08af730333238784bacdfbd14c18e3d1 Mon Sep 17 00:00:00 2001
From: "Daniel H. Brown" <32883970+DHB-MSFT@users.noreply.github.com>
Date: Thu, 6 Feb 2025 13:00:55 -0800
Subject: [PATCH 66/86] Add new endpoint
api.cdp.microsoft.com
---
windows/privacy/manage-windows-11-endpoints.md | 1 +
1 file changed, 1 insertion(+)
diff --git a/windows/privacy/manage-windows-11-endpoints.md b/windows/privacy/manage-windows-11-endpoints.md
index 7c41ff3d2a..4bf198648c 100644
--- a/windows/privacy/manage-windows-11-endpoints.md
+++ b/windows/privacy/manage-windows-11-endpoints.md
@@ -174,6 +174,7 @@ To view endpoints for non-Enterprise Windows 11 editions, see [Windows 11 connec
|||TLSv1.2/HTTPS/HTTP|*.update.microsoft.com|
||The following endpoint is used for compatibility database updates for Windows.|HTTPS|adl.windows.com|
||The following endpoint is used for content regulation. If you turn off traffic for this endpoint, the Windows Update Agent will be unable to contact the endpoint, and fallback behavior will be used. This may result in content being either incorrectly downloaded or not downloaded at all.|TLSv1.2/HTTPS/HTTP|tsfe.trafficshaping.dsp.mp.microsoft.com|
+||The following endpoint is for a public web API used by Windows and other OS-agnostic products to check for new updates. If you disable this endpoint, these products won't be able to check for and apply software updates.|TLSv1.2/HTTPS/HTTP|*.api.cdp.microsoft.com|
|Xbox Live|||[Learn how to turn off traffic to all of the following endpoint(s) for Xbox Live.](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#26-microsoft-store)|
||The following endpoints are used for Xbox Live.|HTTPS|dlassets-ssl.xboxlive.com|
|||TLSv1.2|da.xboxservices.com|
From 0e9bb7b9342aa359f416b36ad1cbf95c4e404915 Mon Sep 17 00:00:00 2001
From: Padma Jayaraman
Date: Fri, 7 Feb 2025 17:25:35 +0530
Subject: [PATCH 67/86] Update docfx.json
---
education/docfx.json | 12 +++++-------
1 file changed, 5 insertions(+), 7 deletions(-)
diff --git a/education/docfx.json b/education/docfx.json
index cc2b912248..41cc74d824 100644
--- a/education/docfx.json
+++ b/education/docfx.json
@@ -53,14 +53,12 @@
"contributors_to_exclude": [
"dstrome2",
"rjagiewich",
- "American-Dipper",
"claydetels19",
- "jborsecnik",
- "v-stchambers",
- "shdyas",
- "Stacyrch140",
"garycentric",
- "dstrome"
+ "dstrome",
+ "padmagit77",
+ "aditisrivastava07",
+ "Ruchika-mittal01"
]
},
"fileMetadata": {
@@ -77,4 +75,4 @@
"dest": "education",
"markdownEngineName": "markdig"
}
-}
\ No newline at end of file
+}
From 17cec89eb27f85d64c057e8ae2babf48f01f1803 Mon Sep 17 00:00:00 2001
From: Christine Eaton <40660908+ceaton-msft@users.noreply.github.com>
Date: Fri, 7 Feb 2025 12:04:07 +0000
Subject: [PATCH 68/86] Update windows-autopatch-hotpatch-updates.md
Corrected link to Release Notes to point to Windows 11 instead of Server 2022.
---
.../manage/windows-autopatch-hotpatch-updates.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/deployment/windows-autopatch/manage/windows-autopatch-hotpatch-updates.md b/windows/deployment/windows-autopatch/manage/windows-autopatch-hotpatch-updates.md
index 5ffdbf1d92..9a78e9814f 100644
--- a/windows/deployment/windows-autopatch/manage/windows-autopatch-hotpatch-updates.md
+++ b/windows/deployment/windows-autopatch/manage/windows-autopatch-hotpatch-updates.md
@@ -37,7 +37,7 @@ Hotpatch is an extension of Windows Update and requires Autopatch to create and
## Release cycles
-For more information about the release calendar for Hotpatch updates, see [Release notes for Hotpatch](https://support.microsoft.com/topic/release-notes-for-hotpatch-in-azure-automanage-for-windows-server-2022-4e234525-5bd5-4171-9886-b475dabe0ce8?preview=true).
+For more information about the release calendar for Hotpatch updates, see [Release notes for Hotpatch](https://support.microsoft.com/en-us/topic/release-notes-for-hotpatch-public-preview-on-windows-11-version-24h2-enterprise-clients-c117ee02-fd35-4612-8ea9-949c5d0ba6d1).
| Quarter | Baseline updates (requires restart) | Hotpatch (no restart required) |
| ----- | ----- | ----- |
From 479898c50eaa3beec0581f4d9035ffbf6db3033a Mon Sep 17 00:00:00 2001
From: Tiara Quan <95256667+tiaraquan@users.noreply.github.com>
Date: Fri, 7 Feb 2025 09:24:56 -0800
Subject: [PATCH 69/86] Fix broken link in Hotpatch updates documentation
removed en-us from url
---
.../manage/windows-autopatch-hotpatch-updates.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/deployment/windows-autopatch/manage/windows-autopatch-hotpatch-updates.md b/windows/deployment/windows-autopatch/manage/windows-autopatch-hotpatch-updates.md
index 9a78e9814f..0cf0c9260b 100644
--- a/windows/deployment/windows-autopatch/manage/windows-autopatch-hotpatch-updates.md
+++ b/windows/deployment/windows-autopatch/manage/windows-autopatch-hotpatch-updates.md
@@ -37,7 +37,7 @@ Hotpatch is an extension of Windows Update and requires Autopatch to create and
## Release cycles
-For more information about the release calendar for Hotpatch updates, see [Release notes for Hotpatch](https://support.microsoft.com/en-us/topic/release-notes-for-hotpatch-public-preview-on-windows-11-version-24h2-enterprise-clients-c117ee02-fd35-4612-8ea9-949c5d0ba6d1).
+For more information about the release calendar for Hotpatch updates, see [Release notes for Hotpatch](https://support.microsoft.com/topic/release-notes-for-hotpatch-public-preview-on-windows-11-version-24h2-enterprise-clients-c117ee02-fd35-4612-8ea9-949c5d0ba6d1).
| Quarter | Baseline updates (requires restart) | Hotpatch (no restart required) |
| ----- | ----- | ----- |
From 841282d72cfe2ff325d40cf694aa08b83e8a9d15 Mon Sep 17 00:00:00 2001
From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com>
Date: Fri, 7 Feb 2025 13:19:04 -0700
Subject: [PATCH 70/86] Update policy-csp-admx-kerberos.md
---
windows/client-management/mdm/policy-csp-admx-kerberos.md | 2 ++
1 file changed, 2 insertions(+)
diff --git a/windows/client-management/mdm/policy-csp-admx-kerberos.md b/windows/client-management/mdm/policy-csp-admx-kerberos.md
index 44ad26e627..8458736726 100644
--- a/windows/client-management/mdm/policy-csp-admx-kerberos.md
+++ b/windows/client-management/mdm/policy-csp-admx-kerberos.md
@@ -172,6 +172,8 @@ This policy setting allows you to specify which DNS host names and which DNS suf
+> [!NOTE]
+> The list of DNS host names and DNS suffixes has a 2048 character limit. This policy would not apply if you exceed this limit.
From 25022aea88ee5baaae298733781cca5991fa1a5c Mon Sep 17 00:00:00 2001
From: Violet Hansen
Date: Sat, 8 Feb 2025 11:22:16 +0200
Subject: [PATCH 71/86] Improved OS support sections and a small format
improvement
Improved OS support sections and a small format improvement
---
.../design/select-types-of-rules-to-create.md | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/windows/security/application-security/application-control/app-control-for-business/design/select-types-of-rules-to-create.md b/windows/security/application-security/application-control/app-control-for-business/design/select-types-of-rules-to-create.md
index 8cdfe418ba..f7a5f2142e 100644
--- a/windows/security/application-security/application-control/app-control-for-business/design/select-types-of-rules-to-create.md
+++ b/windows/security/application-security/application-control/app-control-for-business/design/select-types-of-rules-to-create.md
@@ -130,7 +130,9 @@ There's a defined list of SIDs that App Control recognizes as admins. If a filep
App Control's list of well-known admin SIDs are:
+```
S-1-3-0; S-1-5-18; S-1-5-19; S-1-5-20; S-1-5-32-544; S-1-5-32-549; S-1-5-32-550; S-1-5-32-551; S-1-5-32-577; S-1-5-32-559; S-1-5-32-568; S-1-15-2-1430448594-2639229838-973813799-439329657-1197984847-4069167804-1277922394; S-1-15-2-95739096-486727260-2033287795-3853587803-1685597119-444378811-2746676523.
+```
When filepath rules are generated using [New-CIPolicy](/powershell/module/configci/new-cipolicy), a unique, fully qualified path rule is generated for every file discovered in the scanned path(s). To create rules that instead allow all files under a specified folder path, use [New-CIPolicyRule](/powershell/module/configci/new-cipolicyrule) to define rules containing wildcards, using the [-FilePathRules](/powershell/module/configci/new-cipolicyrule#parameters) switch.
@@ -140,8 +142,8 @@ The following wildcards can be used in App Control filepath rules:
| Wildcard character | Meaning | Supported operating systems |
|------------ | ----------- | ----------- |
-| **`*`** | Matches zero or more characters. | Windows 11, Windows 10, and Windows Server 2022 |
-| **`?`** | Matches a single character. | Windows 11 only |
+| **`*`** | Matches zero or more characters. | Windows 10 and later, or Windows Server 2022 and later |
+| **`?`** | Matches a single character. | Windows 11 and later, or Windows Server 2025 and later |
You can also use the following macros when the exact volume may vary: `%OSDRIVE%`, `%WINDIR%`, `%SYSTEM32%`. These macros can be used in combination with the wildcards above.
@@ -154,9 +156,9 @@ You can also use the following macros when the exact volume may vary: `%OSDRIVE%
| Examples | Description | Supported operating systems |
|------------ | ----------- | ----------- |
-| **C:\\Windows\\\***
**D:\\EnterpriseApps\\MyApp\\\***
**%OSDRIVE%\\Windows\\\*** | Wildcards placed at the end of a path authorize all files in the immediate path and its subdirectories recursively. | Windows 11, Windows 10, and Windows Server 2022 |
-| **\*\\bar.exe** | Wildcards placed at the beginning of a path allow the exact specified filename in any location. | Windows 11, Windows 10, and Windows Server 2022 |
-| **C:\\\*\\CCMCACHE\\\*\\7z????-x64.exe**
**%OSDRIVE%\\\*\\CCMCACHE\\\*\\7z????-x64.exe** | Wildcards used in the middle of a path allow all files that match that pattern. Consider carefully all the possible matches, particularly if your policy disables the admin-writeable check with the **Disabled:Runtime FilePath Rule Protection** option. In this example, both of these hypothetical paths would match:
*`C:\WINDOWS\CCMCACHE\12345\7zabcd-x64.exe`*
*`C:\USERS\AppControlUSER\Downloads\Malware\CCMCACHE\Pwned\7zhaha-x64.exe`* | Windows 11 only |
+| **C:\\Windows\\\***
**D:\\EnterpriseApps\\MyApp\\\***
**%OSDRIVE%\\Windows\\\*** | Wildcards placed at the end of a path authorize all files in the immediate path and its subdirectories recursively. | Windows 10 and later, or Windows Server 2022 and later |
+| **\*\\bar.exe** | Wildcards placed at the beginning of a path allow the exact specified filename in any location. | Windows 10 and later, or Windows Server 2022 and later |
+| **C:\\\*\\CCMCACHE\\\*\\7z????-x64.exe**
**%OSDRIVE%\\\*\\CCMCACHE\\\*\\7z????-x64.exe** | Wildcards used in the middle of a path allow all files that match that pattern. Consider carefully all the possible matches, particularly if your policy disables the admin-writeable check with the **Disabled:Runtime FilePath Rule Protection** option. In this example, both of these hypothetical paths would match:
*`C:\WINDOWS\CCMCACHE\12345\7zabcd-x64.exe`*
*`C:\USERS\AppControlUSER\Downloads\Malware\CCMCACHE\Pwned\7zhaha-x64.exe`* | Windows 11 and later, or Windows Server 2025 and later |
Without a wildcard, the filepath rule allows only a specific file (ex. `C:\foo\bar.exe`).
From 0d86af35cd4c3377dfdd7474a17f4ecdfbda9486 Mon Sep 17 00:00:00 2001
From: Violet Hansen
Date: Sat, 8 Feb 2025 11:35:02 +0200
Subject: [PATCH 72/86] Update supported OS versions in documentation
---
.../design/select-types-of-rules-to-create.md | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/windows/security/application-security/application-control/app-control-for-business/design/select-types-of-rules-to-create.md b/windows/security/application-security/application-control/app-control-for-business/design/select-types-of-rules-to-create.md
index f7a5f2142e..0c9fb3469f 100644
--- a/windows/security/application-security/application-control/app-control-for-business/design/select-types-of-rules-to-create.md
+++ b/windows/security/application-security/application-control/app-control-for-business/design/select-types-of-rules-to-create.md
@@ -142,7 +142,7 @@ The following wildcards can be used in App Control filepath rules:
| Wildcard character | Meaning | Supported operating systems |
|------------ | ----------- | ----------- |
-| **`*`** | Matches zero or more characters. | Windows 10 and later, or Windows Server 2022 and later |
+| **`*`** | Matches zero or more characters. | Windows 10, Windows 11 and later, or Windows Server 2022 and later |
| **`?`** | Matches a single character. | Windows 11 and later, or Windows Server 2025 and later |
You can also use the following macros when the exact volume may vary: `%OSDRIVE%`, `%WINDIR%`, `%SYSTEM32%`. These macros can be used in combination with the wildcards above.
@@ -156,8 +156,8 @@ You can also use the following macros when the exact volume may vary: `%OSDRIVE%
| Examples | Description | Supported operating systems |
|------------ | ----------- | ----------- |
-| **C:\\Windows\\\***
**D:\\EnterpriseApps\\MyApp\\\***
**%OSDRIVE%\\Windows\\\*** | Wildcards placed at the end of a path authorize all files in the immediate path and its subdirectories recursively. | Windows 10 and later, or Windows Server 2022 and later |
-| **\*\\bar.exe** | Wildcards placed at the beginning of a path allow the exact specified filename in any location. | Windows 10 and later, or Windows Server 2022 and later |
+| **C:\\Windows\\\***
**D:\\EnterpriseApps\\MyApp\\\***
**%OSDRIVE%\\Windows\\\*** | Wildcards placed at the end of a path authorize all files in the immediate path and its subdirectories recursively. | Windows 10, Windows 11 and later, or Windows Server 2022 and later |
+| **\*\\bar.exe** | Wildcards placed at the beginning of a path allow the exact specified filename in any location. | Windows 10, Windows 11 and later, or Windows Server 2022 and later |
| **C:\\\*\\CCMCACHE\\\*\\7z????-x64.exe**
**%OSDRIVE%\\\*\\CCMCACHE\\\*\\7z????-x64.exe** | Wildcards used in the middle of a path allow all files that match that pattern. Consider carefully all the possible matches, particularly if your policy disables the admin-writeable check with the **Disabled:Runtime FilePath Rule Protection** option. In this example, both of these hypothetical paths would match:
*`C:\WINDOWS\CCMCACHE\12345\7zabcd-x64.exe`*
*`C:\USERS\AppControlUSER\Downloads\Malware\CCMCACHE\Pwned\7zhaha-x64.exe`* | Windows 11 and later, or Windows Server 2025 and later |
Without a wildcard, the filepath rule allows only a specific file (ex. `C:\foo\bar.exe`).
From 2daa4d8e983387b8a02a064e3f02fd1177a0a88b Mon Sep 17 00:00:00 2001
From: Aditi Srivastava <133841950+aditisrivastava07@users.noreply.github.com>
Date: Mon, 10 Feb 2025 17:16:55 +0530
Subject: [PATCH 73/86] Update contributors_to_exclude list in docfx.json
---
education/docfx.json | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/education/docfx.json b/education/docfx.json
index 41cc74d824..8a348ff39f 100644
--- a/education/docfx.json
+++ b/education/docfx.json
@@ -52,8 +52,13 @@
"titleSuffix": "Windows Education",
"contributors_to_exclude": [
"dstrome2",
- "rjagiewich",
- "claydetels19",
+ "rjagiewich",
+ "American-Dipper",
+ "claydetels19",
+ "jborsecnik",
+ "v-stchambers",
+ "shdyas",
+ "Stacyrch140",
"garycentric",
"dstrome",
"padmagit77",
From 5ea3075b0a67d9bab044443dfb48738cc2aed8c9 Mon Sep 17 00:00:00 2001
From: ChunlinXuMSFT <40968607+ChunlinXuMSFT@users.noreply.github.com>
Date: Tue, 11 Feb 2025 14:25:14 +1100
Subject: [PATCH 74/86] Update faq.yml to fix wrong information cloud trust
compatibility with a real RODC
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
as per internal discussion and tests, we confirmed with engineering team there is a known issue between cloud trust and real RODC:
1. WHfB Cloud trust would only work with RODC if the user’s password can’t be cached by that RODC (as per the password replicdation policy). that is, RODC will to return TGT_Revoked to the client after successfully verifying the partial tgt from WHfB cloud trust client if the user is supposed to have a password cached locally on local RODC.
2. Auth can be successful if the same RODC has KDC certs and then it can failover to Key trust.
---
windows/security/identity-protection/hello-for-business/faq.yml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/security/identity-protection/hello-for-business/faq.yml b/windows/security/identity-protection/hello-for-business/faq.yml
index 26e30724a9..8b205bbe9f 100644
--- a/windows/security/identity-protection/hello-for-business/faq.yml
+++ b/windows/security/identity-protection/hello-for-business/faq.yml
@@ -212,7 +212,7 @@ sections:
This feature doesn't work in a pure on-premises AD domain services environment.
- question: Does Windows Hello for Business cloud Kerberos trust work in a Windows sign-in with RODC present in the hybrid environment?
answer: |
- Windows Hello for Business cloud Kerberos trust looks for a writeable DC to exchange the partial TGT. As long as you have at least one writeable DC per site, login with cloud Kerberos trust will work.
+ Windows Hello for Business cloud Kerberos trust will still work if the client directly talks with a wriable domain controller or talks with RODC which doesn't cache credential of the user who tries to sign-in as per Password Replication Policy. If the client happens to contact a local RODC and the user can cache credentials on the same RODC, Windows Hello for business cloud Kerberos trust may fail. In a production environment, most customers deploy KDC certificates to all domain controllers including RODC to support LDAP over SSL. If so, the authentication will transparently failover to Windows Hello for Business key trust authentication and user signin will still be successful.
- question: Do I need line of sight to a domain controller to use Windows Hello for Business cloud Kerberos trust?
answer: |
Windows Hello for Business cloud Kerberos trust requires line of sight to a domain controller when:
From 6b7593034ce186df2f9046fe8a2aaa1ee93d28d5 Mon Sep 17 00:00:00 2001
From: Sandeep Deo <38295759+SanDeo-MSFT@users.noreply.github.com>
Date: Tue, 11 Feb 2025 01:31:34 -0800
Subject: [PATCH 75/86] Update recovery-process.md
---
.../data-protection/bitlocker/recovery-process.md | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/windows/security/operating-system-security/data-protection/bitlocker/recovery-process.md b/windows/security/operating-system-security/data-protection/bitlocker/recovery-process.md
index 421165a49b..9da8c4e609 100644
--- a/windows/security/operating-system-security/data-protection/bitlocker/recovery-process.md
+++ b/windows/security/operating-system-security/data-protection/bitlocker/recovery-process.md
@@ -2,7 +2,7 @@
title: BitLocker recovery process
description: Learn how to obtain BitLocker recovery information for Microsoft Entra joined, Microsoft Entra hybrid joined, and Active Directory joined devices, and how to restore access to a locked drive.
ms.topic: how-to
-ms.date: 12/05/2024
+ms.date: 02/11/2025
---
# BitLocker recovery process
@@ -75,7 +75,7 @@ The following list can be used as a template for creating a recovery process for
There are a few Microsoft Entra ID roles that allow a delegated administrator to read BitLocker recovery passwords from the devices in the tenant. While it's common for organizations to use the existing Microsoft Entra ID *[Cloud Device Administrator][ENTRA-2]* or *[Helpdesk Administrator][ENTRA-3]* built-in roles, you can also [create a custom role][ENTRA-5], delegating access to BitLocker keys using the `microsoft.directory/bitlockerKeys/key/read` permission. Roles can be delegated to access BitLocker recovery passwords for devices in specific Administrative Units.
> [!NOTE]
-> When devices that utilize [Windows Autopilot](/mem/autopilot/windows-autopilot) are reused to join to Entra, **and there is a new device owner**, that new device owner must contact an administrator to acquire the BitLocker recovery key for that device. Custom role or administrative unit scoped administrators will lose access to BitLocker recovery keys for those devices that have undergone device ownership changes. These scoped administrators will need to contact a non-scoped administrator for the recovery keys. For more information, see the article [Find the primary user of an Intune device](/mem/intune/remote-actions/find-primary-user#change-a-devices-primary-user).
+> When devices that utilize [Windows Autopilot](/mem/autopilot/windows-autopilot) are reused to join to Entra, **and there is a new device owner**, that new device owner must contact an administrator to acquire the BitLocker recovery key for that device. Custom role or administrative unit scoped administrators will continue to have access to BitLocker recovery keys for those devices that have undergone device ownership changes, unless the new device owner belongs to a custom role or adminstrative unit scope. In such an instance, the user will need to contact other scoped administrator for the recovery keys. For more information, see the article [Find the primary user of an Intune device](/mem/intune/remote-actions/find-primary-user#change-a-devices-primary-user).
The [Microsoft Entra admin center][ENTRA] allows administrators to retrieve BitLocker recovery passwords. To learn more about the process, see [View or copy BitLocker keys][ENTRA-4]. Another option to access BitLocker recovery passwords is to use the Microsoft Graph API, which might be useful for integrated or scripted solutions. For more information about this option, see [Get bitlockerRecoveryKey][GRAPH-1].
From be01c9505b1841227efd0bbcb666403a5e1bb06e Mon Sep 17 00:00:00 2001
From: "Vinay Pamnani (from Dev Box)"
Date: Tue, 11 Feb 2025 12:23:51 -0700
Subject: [PATCH 76/86] January 2025 CSP Updates
---
.../mdm/policies-in-preview.md | 16 +++--
.../mdm/policy-csp-applicationmanagement.md | 56 ++++++++++++++-
.../mdm/policy-csp-connectivity.md | 2 +-
...policy-csp-localpoliciessecurityoptions.md | 69 +++++++++----------
.../mdm/policy-csp-newsandinterests.md | 60 +++++++++++++++-
.../mdm/policy-csp-settingssync.md | 54 ++++++++++++++-
.../mdm/policy-csp-windowsai.md | 14 ++--
windows/client-management/mdm/reboot-csp.md | 12 ++--
.../client-management/mdm/reboot-ddf-file.md | 12 ++--
9 files changed, 231 insertions(+), 64 deletions(-)
diff --git a/windows/client-management/mdm/policies-in-preview.md b/windows/client-management/mdm/policies-in-preview.md
index a728e43011..8bce8b6a6e 100644
--- a/windows/client-management/mdm/policies-in-preview.md
+++ b/windows/client-management/mdm/policies-in-preview.md
@@ -1,7 +1,7 @@
---
title: Configuration service provider preview policies
description: Learn more about configuration service provider (CSP) policies that are available for Windows Insider Preview.
-ms.date: 01/14/2025
+ms.date: 02/11/2025
---
@@ -19,6 +19,10 @@ This article lists the policies that are applicable for Windows Insider Preview
- [TurnOffApplicationFootprint](policy-csp-appdeviceinventory.md#turnoffapplicationfootprint)
- [TurnOffWin32AppBackup](policy-csp-appdeviceinventory.md#turnoffwin32appbackup)
+## ApplicationManagement
+
+- [AllowedNonAdminPackageFamilyNameRules](policy-csp-applicationmanagement.md#allowednonadminpackagefamilynamerules)
+
## ClientCertificateInstall CSP
- [AttestPrivateKey](clientcertificateinstall-csp.md#userscepuniqueidinstallattestprivatekey)
@@ -108,6 +112,7 @@ This article lists the policies that are applicable for Windows Insider Preview
## LocalPoliciesSecurityOptions
+- [InteractiveLogon_NumberOfPreviousLogonsToCache](policy-csp-localpoliciessecurityoptions.md#interactivelogon_numberofpreviouslogonstocache)
- [UserAccountControl_BehaviorOfTheElevationPromptForAdministratorProtection](policy-csp-localpoliciessecurityoptions.md#useraccountcontrol_behavioroftheelevationpromptforadministratorprotection)
- [UserAccountControl_TypeOfAdminApprovalMode](policy-csp-localpoliciessecurityoptions.md#useraccountcontrol_typeofadminapprovalmode)
@@ -121,6 +126,7 @@ This article lists the policies that are applicable for Windows Insider Preview
## NewsAndInterests
- [DisableWidgetsOnLockScreen](policy-csp-newsandinterests.md#disablewidgetsonlockscreen)
+- [DisableWidgetsBoard](policy-csp-newsandinterests.md#disablewidgetsboard)
## PassportForWork CSP
@@ -130,14 +136,14 @@ This article lists the policies that are applicable for Windows Insider Preview
- [ConfigureIppTlsCertificatePolicy](policy-csp-printers.md#configureipptlscertificatepolicy)
-## Reboot CSP
-
-- [WeeklyRecurrent](reboot-csp.md#scheduleweeklyrecurrent)
-
## RemoteDesktopServices
- [TS_SERVER_REMOTEAPP_USE_SHELLAPPRUNTIME](policy-csp-remotedesktopservices.md#ts_server_remoteapp_use_shellappruntime)
+## SettingsSync
+
+- [EnableWindowsbackup](policy-csp-settingssync.md#enablewindowsbackup)
+
## Start
- [AlwaysShowNotificationIcon](policy-csp-start.md#alwaysshownotificationicon)
diff --git a/windows/client-management/mdm/policy-csp-applicationmanagement.md b/windows/client-management/mdm/policy-csp-applicationmanagement.md
index 64cecc6c0c..2fc29f5665 100644
--- a/windows/client-management/mdm/policy-csp-applicationmanagement.md
+++ b/windows/client-management/mdm/policy-csp-applicationmanagement.md
@@ -1,7 +1,7 @@
---
title: ApplicationManagement Policy CSP
description: Learn more about the ApplicationManagement Area in Policy CSP.
-ms.date: 11/26/2024
+ms.date: 02/11/2025
---
@@ -9,6 +9,10 @@ ms.date: 11/26/2024
# Policy CSP - ApplicationManagement
+[!INCLUDE [ADMX-backed CSP tip](includes/mdm-admx-csp-note.md)]
+
+[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)]
+
@@ -283,6 +287,56 @@ Allows or denies development of Microsoft Store applications and installing them
+
+## AllowedNonAdminPackageFamilyNameRules
+
+
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| ✅ Device
❌ User | ❌ Pro
✅ Enterprise
✅ Education
❌ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
+
+
+
+```Device
+./Device/Vendor/MSFT/Policy/Config/ApplicationManagement/AllowedNonAdminPackageFamilyNameRules
+```
+
+
+
+
+
+
+
+
+
+
+
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | `chr` (string) |
+| Access Type | Add, Delete, Get, Replace |
+
+
+
+
+[!INCLUDE [ADMX-backed policy note](includes/mdm-admx-policy-note.md)]
+
+**ADMX mapping**:
+
+| Name | Value |
+|:--|:--|
+| Name | AllowedNonAdminPackageFamilyNameRules |
+| ADMX File Name | AppxPackageManager.admx |
+
+
+
+
+
+
+
+
## AllowGameDVR
diff --git a/windows/client-management/mdm/policy-csp-connectivity.md b/windows/client-management/mdm/policy-csp-connectivity.md
index a58ea71af2..4fc9aba757 100644
--- a/windows/client-management/mdm/policy-csp-connectivity.md
+++ b/windows/client-management/mdm/policy-csp-connectivity.md
@@ -1,7 +1,7 @@
---
title: Connectivity Policy CSP
description: Learn more about the Connectivity Area in Policy CSP.
-ms.date: 01/14/2025
+ms.date: 02/11/2025
---
diff --git a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md
index 3c37204919..d0b6243ed4 100644
--- a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md
+++ b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md
@@ -1,7 +1,7 @@
---
title: LocalPoliciesSecurityOptions Policy CSP
description: Learn more about the LocalPoliciesSecurityOptions Area in Policy CSP.
-ms.date: 11/05/2024
+ms.date: 02/11/2025
---
@@ -9,7 +9,7 @@ ms.date: 11/05/2024
# Policy CSP - LocalPoliciesSecurityOptions
-[!INCLUDE [Windows Windows Insider Preview tip](includes/mdm-insider-csp-note.md)]
+[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)]
@@ -517,7 +517,7 @@ Audit: Shut down system immediately if unable to log security audits This securi
-Devices: Allowed to format and eject removable media This security setting determines who is allowed to format and eject removable NTFS media. This capability can be given to: Administrators and Interactive Users Default: This policy isn't defined and only Administrators have this ability.
+Devices: Allowed to format and eject removable media This security setting determines who is allowed to format and eject removable NTFS media. This capability can be given to: Administrators Administrators and Interactive Users Default: This policy isn't defined and only Administrators have this ability.
@@ -1117,7 +1117,7 @@ Domain member: Require strong (Windows 2000 or later) session key This security
-Interactive Logon: Display user information when the session is locked User display name, domain and user names (1) User display name only (2) Don't display user information (3) Domain and user names only (4)
+Interactive Logon:Display user information when the session is locked User display name, domain and user names (1) User display name only (2) Don't display user information (3) Domain and user names only (4)
@@ -1568,13 +1568,12 @@ Interactive logon: Message title for users attempting to log on This security se
Interactive logon: Number of previous logons to cache (in case domain controller isn't available) Each unique user's logon information is cached locally so that, in the event that a domain controller is unavailable during subsequent logon attempts, they're able to log on. The cached logon information is stored from the previous logon session. If a domain controller is unavailable and a user's logon information isn't cached, the user is prompted with this message: There are currently no logon servers available to service the logon request. In this policy setting, a value of 0 disables logon caching. Any value above 50 only caches 50 logon attempts. Windows supports a maximum of 50 cache entries and the number of entries consumed per user depends on the credential. For example, a maximum of 50 unique password user accounts can be cached on a Windows system, but only 25 smart card user accounts can be cached because both the password information and the smart card information are stored. When a user with cached logon information logs on again, the user's individual cached information is replaced. Default: Windows Server 2008: 25 All Other Versions: 10.
-
-> [!NOTE]
-> This setting previously showed as applicable to Windows 11, version 24H2 [10.0.26100] and later in error. MDM solutions may show as applicable to that version until a future release.
+> [!NOTE]
+> This setting previously showed as applicable to Windows 11, version 24H2 [10.0.26100] and later in error. MDM solutions may show as applicable to that version until a future release.
@@ -1783,7 +1782,7 @@ Microsoft network client: Digitally sign communications (if server agrees) This
- If this setting is enabled, the Microsoft network client will ask the server to perform SMB packet signing upon session setup. If packet signing has been enabled on the server, packet signing will be negotiated.
-- If this policy is disabled, the SMB client will never negotiate SMB packet signing. Notes All Windows operating systems support both a client-side SMB component and a server-side SMB component. On Windows 2000 and later, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings: Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. If both client-side and server-side SMB signing are enabled and the client establishes an SMB 1.0 connection to the server, SMB signing will be attempted. SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. This setting only applies to SMB 1.0 connections. For more information, reference:< https://go.microsoft.com/fwlink/?LinkID=787136>.
+- If this policy is disabled, the SMB client will never negotiate SMB packet signing. Notes All Windows operating systems support both a client-side SMB component and a server-side SMB component. On Windows 2000 and later, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings: Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. If both client-side and server-side SMB signing is enabled and the client establishes an SMB 1.0 connection to the server, SMB signing will be attempted. SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. This setting only applies to SMB 1.0 connections. For more information, reference:< https://go.microsoft.com/fwlink/?LinkID=787136>.
@@ -2024,7 +2023,7 @@ Microsoft network server: Digitally sign communications (if client agrees) This
- If this policy is disabled, the SMB client will never negotiate SMB packet signing. on domain controllers only.
> [!IMPORTANT]
-> For Windows 2000 servers to negotiate signing with Windows NT 4.0 clients, the following registry value must be set to 1 on the server running Windows 2000: HKLM\System\CurrentControlSet\Services\lanmanserver\parameters\enableW9xsecuritysignature Notes All Windows operating systems support both a client-side SMB component and a server-side SMB component. For Windows 2000 and above, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings: Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. If both client-side and server-side SMB signing are enabled and the client establishes an SMB 1.0 connection to the server, SMB signing will be attempted. SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. This setting only applies to SMB 1.0 connections. For more information, reference:< https://go.microsoft.com/fwlink/?LinkID=787136>.
+> For Windows 2000 servers to negotiate signing with Windows NT 4.0 clients, the following registry value must be set to 1 on the server running Windows 2000: HKLM\System\CurrentControlSet\Services\lanmanserver\parameters\enableW9xsecuritysignature Notes All Windows operating systems support both a client-side SMB component and a server-side SMB component. For Windows 2000 and above, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings: Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. If both client-side and server-side SMB signing is enabled and the client establishes an SMB 1.0 connection to the server, SMB signing will be attempted. SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. This setting only applies to SMB 1.0 connections. For more information, reference:< https://go.microsoft.com/fwlink/?LinkID=787136>.
@@ -3865,9 +3864,9 @@ System objects: Strengthen default permissions of internal system objects (e.g.,
-User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop. This policy setting controls whether User Interface Accessibility (UIAccess or UIA) programs can automatically disable the secure desktop for elevation prompts used by a standard user.
+User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop. This policy setting controls whether User Interface Accessibility (UIAccess or UIA) programs can automatically disable the secure desktop for elevation prompts used by a standard user.
-- Enabled: UIA programs, including Windows Remote Assistance, automatically disable the secure desktop for elevation prompts. If you don't disable the "User Account Control: Switch to the secure desktop when prompting for elevation" policy setting, the prompts appear on the interactive user's desktop instead of the secure desktop.
+- Enabled: UIA programs, including Windows Remote Assistance, automatically disable the secure desktop for elevation prompts. If you don't disable the "User Account Control: Switch to the secure desktop when prompting for elevation" policy setting, the prompts appear on the interactive user's desktop instead of the secure desktop.
- Disabled: (Default) The secure desktop can be disabled only by the user of the interactive desktop or by disabling the "User Account Control: Switch to the secure desktop when prompting for elevation" policy setting.
@@ -3927,9 +3926,9 @@ User Account Control: Allow UIAccess applications to prompt for elevation withou
-User Account Control: Behavior of the elevation prompt for administrators running with Administrator protection. This policy setting controls the behavior of the elevation prompt for administrators. The options are:
+User Account Control: Behavior of the elevation prompt for administrators running with Administrator protection. This policy setting controls the behavior of the elevation prompt for administrators. The options are:
-- Prompt for credentials on the secure desktop: When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a privileged credentials. If the user enters valid credentials, the operation continues with the user's highest available privilege.
+- Prompt for credentials on the secure desktop: When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a privileged credentials. If the user enters valid credentials, the operation continues with the user's highest available privilege.
- Prompt for consent on the secure desktop: When an operation requires elevation of privilege, the user is prompted on the secure desktop to select either Allow changes or Don't allow. If the user selects Allow changes, the operation continues with the user's highest available privilege.
@@ -3991,20 +3990,20 @@ User Account Control: Behavior of the elevation prompt for administrators runnin
-User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode This policy setting controls the behavior of the elevation prompt for administrators. The options are:
+User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode This policy setting controls the behavior of the elevation prompt for administrators. The options are:
-- Elevate without prompting: Allows privileged accounts to perform an operation that requires elevation without requiring consent or credentials.
+- Elevate without prompting: Allows privileged accounts to perform an operation that requires elevation without requiring consent or credentials.
>[!NOTE]
- > Use this option only in the most constrained environments.
+ > Use this option only in the most constrained environments.
-- Prompt for credentials on the secure desktop: When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a privileged user name and password. If the user enters valid credentials, the operation continues with the user's highest available privilege.
+- Prompt for credentials on the secure desktop: When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a privileged user name and password. If the user enters valid credentials, the operation continues with the user's highest available privilege.
-- Prompt for consent on the secure desktop: When an operation requires elevation of privilege, the user is prompted on the secure desktop to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege.
+- Prompt for consent on the secure desktop: When an operation requires elevation of privilege, the user is prompted on the secure desktop to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege.
-- Prompt for credentials: When an operation requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege.
+- Prompt for credentials: When an operation requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege.
-- Prompt for consent: When an operation requires elevation of privilege, the user is prompted to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege.
+- Prompt for consent: When an operation requires elevation of privilege, the user is prompted to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege.
- Prompt for consent for non-Windows binaries: (Default) When an operation for a non-Microsoft application requires elevation of privilege, the user is prompted on the secure desktop to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege.
@@ -4070,11 +4069,11 @@ User Account Control: Behavior of the elevation prompt for administrators in Adm
-User Account Control: Behavior of the elevation prompt for standard users This policy setting controls the behavior of the elevation prompt for standard users. The options are:
+User Account Control: Behavior of the elevation prompt for standard users This policy setting controls the behavior of the elevation prompt for standard users. The options are:
-- Prompt for credentials: (Default) When an operation requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege.
+- Prompt for credentials: (Default) When an operation requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege.
-- Automatically deny elevation requests: When an operation requires elevation of privilege, a configurable access denied error message is displayed. An enterprise that's running desktops as standard user may choose this setting to reduce help desk calls.
+- Automatically deny elevation requests: When an operation requires elevation of privilege, a configurable access denied error message is displayed. An enterprise that's running desktops as standard user may choose this setting to reduce help desk calls.
- Prompt for credentials on the secure desktop: When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a different user name and password. If the user enters valid credentials, the operation continues with the applicable privilege.
@@ -4193,9 +4192,9 @@ User Account Control: Detect application installations and prompt for elevation
-User Account Control: Only elevate executable files that are signed and validated This policy setting enforces public key infrastructure (PKI) signature checks for any interactive applications that request elevation of privilege. Enterprise administrators can control which applications are allowed to run by adding certificates to the Trusted Publishers certificate store on local computers. The options are:
+User Account Control: Only elevate executable files that are signed and validated This policy setting enforces public key infrastructure (PKI) signature checks for any interactive applications that request elevation of privilege. Enterprise administrators can control which applications are allowed to run by adding certificates to the Trusted Publishers certificate store on local computers. The options are:
-- Enabled: Enforces the PKI certification path validation for a given executable file before it's permitted to run.
+- Enabled: Enforces the PKI certification path validation for a given executable file before it's permitted to run.
- Disabled: (Default) Does not enforce PKI certification path validation before a given executable file is permitted to run.
@@ -4255,9 +4254,9 @@ User Account Control: Only elevate executable files that are signed and validate
-User Account Control: Only elevate UIAccess applications that are installed in secure locations This policy setting controls whether applications that request to run with a User Interface Accessibility (UIAccess) integrity level must reside in a secure location in the file system. Secure locations are limited to the following: - ..\Program Files\, including subfolders - ..\Windows\system32\ - ..\Program Files (x86)\, including subfolders for 64-bit versions of Windows Note: Windows enforces a public key infrastructure (PKI) signature check on any interactive application that requests to run with a UIAccess integrity level regardless of the state of this security setting. The options are:
+User Account Control: Only elevate UIAccess applications that are installed in secure locations This policy setting controls whether applications that request to run with a User Interface Accessibility (UIAccess) integrity level must reside in a secure location in the file system. Secure locations are limited to the following: - ..\Program Files\, including subfolders - ..\Windows\system32\ - ..\Program Files (x86)\, including subfolders for 64-bit versions of Windows Note: Windows enforces a public key infrastructure (PKI) signature check on any interactive application that requests to run with a UIAccess integrity level regardless of the state of this security setting. The options are:
-- Enabled: (Default) If an application resides in a secure location in the file system, it runs only with UIAccess integrity.
+- Enabled: (Default) If an application resides in a secure location in the file system, it runs only with UIAccess integrity.
- Disabled: An application runs with UIAccess integrity even if it doesn't reside in a secure location in the file system.
@@ -4317,9 +4316,9 @@ User Account Control: Only elevate UIAccess applications that are installed in s
-User Account Control: Turn on Admin Approval Mode This policy setting controls the behavior of all User Account Control (UAC) policy settings for the computer. If you change this policy setting, you must restart your computer. The options are:
+User Account Control: Turn on Admin Approval Mode This policy setting controls the behavior of all User Account Control (UAC) policy settings for the computer. If you change this policy setting, you must restart your computer. The options are:
-- Enabled: (Default) Admin Approval Mode is enabled. This policy must be enabled and related UAC policy settings must also be set appropriately to allow the built-in Administrator account and all other users who are members of the Administrators group to run in Admin Approval Mode.
+- Enabled: (Default) Admin Approval Mode is enabled. This policy must be enabled and related UAC policy settings must also be set appropriately to allow the built-in Administrator account and all other users who are members of the Administrators group to run in Admin Approval Mode.
- Disabled: Admin Approval Mode and all related UAC policy settings are disabled.
@@ -4382,9 +4381,9 @@ User Account Control: Turn on Admin Approval Mode This policy setting controls t
-User Account Control: Switch to the secure desktop when prompting for elevation This policy setting controls whether the elevation request prompt is displayed on the interactive user's desktop or the secure desktop. The options are:
+User Account Control: Switch to the secure desktop when prompting for elevation This policy setting controls whether the elevation request prompt is displayed on the interactive user's desktop or the secure desktop. The options are:
-- Enabled: (Default) All elevation requests go to the secure desktop regardless of prompt behavior policy settings for administrators and standard users.
+- Enabled: (Default) All elevation requests go to the secure desktop regardless of prompt behavior policy settings for administrators and standard users.
- Disabled: All elevation requests go to the interactive user's desktop. Prompt behavior policy settings for administrators and standard users are used.
@@ -4502,9 +4501,9 @@ User Account Control: Configure type of Admin Approval Mode. This policy setting
-User Account Control: Use Admin Approval Mode for the built-in Administrator account This policy setting controls the behavior of Admin Approval Mode for the built-in Administrator account. The options are:
+User Account Control: Use Admin Approval Mode for the built-in Administrator account This policy setting controls the behavior of Admin Approval Mode for the built-in Administrator account. The options are:
-- Enabled: The built-in Administrator account uses Admin Approval Mode. By default, any operation that requires elevation of privilege will prompt the user to approve the operation.
+- Enabled: The built-in Administrator account uses Admin Approval Mode. By default, any operation that requires elevation of privilege will prompt the user to approve the operation.
- Disabled: (Default) The built-in Administrator account runs all applications with full administrative privilege.
@@ -4564,9 +4563,9 @@ User Account Control: Use Admin Approval Mode for the built-in Administrator acc
-User Account Control: Virtualize file and registry write failures to per-user locations This policy setting controls whether application write failures are redirected to defined registry and file system locations. This policy setting mitigates applications that run as administrator and write run-time application data to %ProgramFiles%, %Windir%, %Windir%\system32, or HKLM\Software. The options are:
+User Account Control: Virtualize file and registry write failures to per-user locations This policy setting controls whether application write failures are redirected to defined registry and file system locations. This policy setting mitigates applications that run as administrator and write run-time application data to %ProgramFiles%, %Windir%, %Windir%\system32, or HKLM\Software. The options are:
-- Enabled: (Default) Application write failures are redirected at run time to defined user locations for both the file system and registry.
+- Enabled: (Default) Application write failures are redirected at run time to defined user locations for both the file system and registry.
- Disabled: Applications that write data to protected locations fail.
diff --git a/windows/client-management/mdm/policy-csp-newsandinterests.md b/windows/client-management/mdm/policy-csp-newsandinterests.md
index df2f909bd6..b070afc551 100644
--- a/windows/client-management/mdm/policy-csp-newsandinterests.md
+++ b/windows/client-management/mdm/policy-csp-newsandinterests.md
@@ -1,7 +1,7 @@
---
title: NewsAndInterests Policy CSP
description: Learn more about the NewsAndInterests Area in Policy CSP.
-ms.date: 11/27/2024
+ms.date: 02/11/2025
---
@@ -84,6 +84,64 @@ This policy applies to the entire widgets experience, including content on the t
+
+## DisableWidgetsBoard
+
+
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
+
+
+
+```Device
+./Device/Vendor/MSFT/Policy/Config/NewsAndInterests/DisableWidgetsBoard
+```
+
+
+
+
+Disable widgets board.
+
+
+
+
+
+
+
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | `int` |
+| Access Type | Add, Delete, Get, Replace |
+| Default Value | 0 |
+
+
+
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| 0 (Default) | Enabled. |
+| 1 | Disabled. |
+
+
+
+**Group policy mapping**:
+
+| Name | Value |
+|:--|:--|
+| Name | DisableWidgetsBoard |
+| Path | NewsAndInterests > AT > WindowsComponents > NewsAndInterests |
+
+
+
+
+
+
+
+
## DisableWidgetsOnLockScreen
diff --git a/windows/client-management/mdm/policy-csp-settingssync.md b/windows/client-management/mdm/policy-csp-settingssync.md
index e8025d4898..5016dff037 100644
--- a/windows/client-management/mdm/policy-csp-settingssync.md
+++ b/windows/client-management/mdm/policy-csp-settingssync.md
@@ -1,7 +1,7 @@
---
title: SettingsSync Policy CSP
description: Learn more about the SettingsSync Area in Policy CSP.
-ms.date: 09/27/2024
+ms.date: 02/11/2025
---
@@ -11,6 +11,8 @@ ms.date: 09/27/2024
[!INCLUDE [ADMX-backed CSP tip](includes/mdm-admx-csp-note.md)]
+[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)]
+
@@ -137,6 +139,56 @@ If you don't set or disable this setting, syncing of the "language preferences"
+
+## EnableWindowsbackup
+
+
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
+
+
+
+```Device
+./Device/Vendor/MSFT/Policy/Config/SettingsSync/EnableWindowsbackup
+```
+
+
+
+
+
+
+
+
+
+
+
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | `chr` (string) |
+| Access Type | Add, Delete, Get, Replace |
+
+
+
+
+[!INCLUDE [ADMX-backed policy note](includes/mdm-admx-policy-note.md)]
+
+**ADMX mapping**:
+
+| Name | Value |
+|:--|:--|
+| Name | EnableWindowsbackup |
+| ADMX File Name | SettingSync.admx |
+
+
+
+
+
+
+
+
diff --git a/windows/client-management/mdm/policy-csp-windowsai.md b/windows/client-management/mdm/policy-csp-windowsai.md
index 8633998eec..2188f397f9 100644
--- a/windows/client-management/mdm/policy-csp-windowsai.md
+++ b/windows/client-management/mdm/policy-csp-windowsai.md
@@ -1,7 +1,7 @@
---
title: WindowsAI Policy CSP
description: Learn more about the WindowsAI Area in Policy CSP.
-ms.date: 12/09/2024
+ms.date: 02/11/2025
---
@@ -659,12 +659,12 @@ When this setting isn't configured, the OS configures the storage allocation for
| Value | Description |
|:--|:--|
| 0 (Default) | Let the OS define the maximum storage amount based on hard drive storage size. |
-| 10000 | 10GB. |
-| 25000 | 25GB. |
-| 50000 | 50GB. |
-| 75000 | 75GB. |
-| 100000 | 100GB. |
-| 150000 | 150GB. |
+| 10240 | 10GB. |
+| 25600 | 25GB. |
+| 51200 | 50GB. |
+| 76800 | 75GB. |
+| 102400 | 100GB. |
+| 153600 | 150GB. |
diff --git a/windows/client-management/mdm/reboot-csp.md b/windows/client-management/mdm/reboot-csp.md
index b095998bbd..7b8903d816 100644
--- a/windows/client-management/mdm/reboot-csp.md
+++ b/windows/client-management/mdm/reboot-csp.md
@@ -1,7 +1,7 @@
---
title: Reboot CSP
description: Learn more about the Reboot CSP.
-ms.date: 01/18/2024
+ms.date: 02/11/2025
---
@@ -9,8 +9,6 @@ ms.date: 01/18/2024
# Reboot CSP
-[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)]
-
The Reboot configuration service provider is used to configure reboot settings.
@@ -122,7 +120,7 @@ The supported operation is Get.
-Value in ISO8601, time is required. Either setting DailyRecurrent or WeeklyRecurrent is supported but not both at same time. A reboot will be scheduled each day at the configured time starting at the date and time. Setting a null (empty) date will delete the existing schedule.
+Value in ISO8601 date and time format (such as 2025-10-07. T10:35:00) is required. While it's supported to set either DailyRecurrent or WeeklyRecurrent schedules, it isn't supported to enable both settings simultaneously. A reboot will be scheduled to occur every day at the configured time starting at the specified date and time. Setting a null (empty) date will delete the existing schedule.
@@ -161,7 +159,7 @@ Value in ISO8601, time is required. Either setting DailyRecurrent or WeeklyRecur
-Value in ISO8601, both the date and time are required. A reboot will be scheduled at the configured date time. Setting a null (empty) date will delete the existing schedule.
+Value in ISO8601 date and time format (such as 2025-10-07. T10:35:00) is required. Both the date and time are required. A reboot will be scheduled to occur at the specified date and time. Setting a null (empty) date will delete the existing schedule.
@@ -189,7 +187,7 @@ Value in ISO8601, both the date and time are required. A reboot will be schedule
| Scope | Editions | Applicable OS |
|:--|:--|:--|
-| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
+| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later |
@@ -200,7 +198,7 @@ Value in ISO8601, both the date and time are required. A reboot will be schedule
-Value in ISO8601, time is required. Either setting DailyRecurrent or WeeklyRecurrent is supported but not both at same time. A reboot will be scheduled every week at the configured time starting at the date and time. Setting a null (empty) date will delete the existing schedule.
+Value in ISO8601 date and time format (such as 2025-10-07. T10:35:00) is required. While it's supported to set either DailyRecurrent or WeeklyRecurrent schedules, it isn't supported to enable both settings simultaneously. A reboot will be scheduled to occur every week at the configured day and time starting at the specified date and time. Setting a null (empty) date will delete the existing schedule.
diff --git a/windows/client-management/mdm/reboot-ddf-file.md b/windows/client-management/mdm/reboot-ddf-file.md
index ab06e22815..6a23c0924b 100644
--- a/windows/client-management/mdm/reboot-ddf-file.md
+++ b/windows/client-management/mdm/reboot-ddf-file.md
@@ -1,7 +1,7 @@
---
title: Reboot DDF file
description: View the XML file containing the device description framework (DDF) for the Reboot configuration service provider.
-ms.date: 06/28/2024
+ms.date: 02/11/2025
---
@@ -95,7 +95,7 @@ The following XML file contains the device description framework (DDF) for the R
- Value in ISO8601, both the date and time are required. A reboot will be scheduled at the configured date time. Setting a null (empty) date will delete the existing schedule.
+ Value in ISO8601 date and time format (such as 2025-10-07T10:35:00) is required. Both the date and time are required. A reboot will be scheduled to occur at the specified date and time. Setting a null (empty) date will delete the existing schedule.
@@ -122,7 +122,7 @@ The following XML file contains the device description framework (DDF) for the R
- Value in ISO8601, time is required. Either setting DailyRecurrent or WeeklyRecurrent is supported but not both at same time. A reboot will be scheduled each day at the configured time starting at the date and time. Setting a null (empty) date will delete the existing schedule.
+ Value in ISO8601 date and time format (such as 2025-10-07T10:35:00) is required. While it is supported to set either DailyRecurrent or WeeklyRecurrent schedules, it is not supported to enable both settings simultaneously. A reboot will be scheduled to occur every day at the configured time starting at the specified date and time. Setting a null (empty) date will delete the existing schedule.
@@ -149,7 +149,7 @@ The following XML file contains the device description framework (DDF) for the R
- Value in ISO8601, time is required. Either setting DailyRecurrent or WeeklyRecurrent is supported but not both at same time. A reboot will be scheduled every week at the configured time starting at the date and time. Setting a null (empty) date will delete the existing schedule.
+ Value in ISO8601 date and time format (such as 2025-10-07T10:35:00) is required. While it is supported to set either DailyRecurrent or WeeklyRecurrent schedules, it is not supported to enable both settings simultaneously. A reboot will be scheduled to occur every week at the configured day and time starting at the specified date and time. Setting a null (empty) date will delete the existing schedule.
@@ -164,8 +164,8 @@ The following XML file contains the device description framework (DDF) for the R
- 99.9.99999
- 9.9
+ 10.0.26100
+ 1.0
From 9232384c97a717816b080d964debc5c1a6c88308 Mon Sep 17 00:00:00 2001
From: Ruchika Mittal
Date: Wed, 12 Feb 2025 02:01:07 +0530
Subject: [PATCH 77/86] acro fix
---
windows/client-management/mdm/policy-csp-connectivity.md | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/windows/client-management/mdm/policy-csp-connectivity.md b/windows/client-management/mdm/policy-csp-connectivity.md
index 4fc9aba757..695c626c56 100644
--- a/windows/client-management/mdm/policy-csp-connectivity.md
+++ b/windows/client-management/mdm/policy-csp-connectivity.md
@@ -314,7 +314,7 @@ This policy is deprecated.
-This policy allows IT admins to turn off the ability to Link a Phone with a PC to continue reading, emailing and other tasks that requires linking between Phone and PC.
+This policy allows IT admins to turn off the ability to Link a Phone with a PC to continue reading, emailing and other tasks that require linking between Phone and PC.
- If you enable this policy setting, the Windows device will be able to enroll in Phone-PC linking functionality and participate in Continue on PC experiences.
@@ -1014,7 +1014,7 @@ Determines whether a user can install and configure the Network Bridge.
> [!IMPORTANT]
> This settings is location aware. It only applies when a computer is connected to the same DNS domain network it was connected to when the setting was refreshed on that computer. If a computer is connected to a DNS domain network other than the one it was connected to when the setting was refreshed, this setting doesn't apply.
-The Network Bridge allows users to create a layer 2 MAC bridge, enabling them to connect two or more network segements together. This connection appears in the Network Connections folder.
+The Network Bridge allows users to create a layer 2 MAC bridge, enabling them to connect two or more network segments together. This connection appears in the Network Connections folder.
If you disable this setting or don't configure it, the user will be able to create and modify the configuration of a Network Bridge. Enabling this setting doesn't remove an existing Network Bridge from the user's computer.
From 8e410be417e7a266a55368e80715311a3c56570c Mon Sep 17 00:00:00 2001
From: Ruchika Mittal
Date: Wed, 12 Feb 2025 02:07:13 +0530
Subject: [PATCH 78/86] acro fix
---
windows/client-management/mdm/policy-csp-connectivity.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/client-management/mdm/policy-csp-connectivity.md b/windows/client-management/mdm/policy-csp-connectivity.md
index 695c626c56..ddefe2ddfe 100644
--- a/windows/client-management/mdm/policy-csp-connectivity.md
+++ b/windows/client-management/mdm/policy-csp-connectivity.md
@@ -1012,7 +1012,7 @@ For more information, see [MS15-011: Vulnerability in Group Policy could allow r
Determines whether a user can install and configure the Network Bridge.
> [!IMPORTANT]
-> This settings is location aware. It only applies when a computer is connected to the same DNS domain network it was connected to when the setting was refreshed on that computer. If a computer is connected to a DNS domain network other than the one it was connected to when the setting was refreshed, this setting doesn't apply.
+> This setting is location aware. It only applies when a computer is connected to the same DNS domain network it was connected to when the setting was refreshed on that computer. If a computer is connected to a DNS domain network other than the one it was connected to when the setting was refreshed, this setting doesn't apply.
The Network Bridge allows users to create a layer 2 MAC bridge, enabling them to connect two or more network segments together. This connection appears in the Network Connections folder.
From f0558dcafa73f840b2976dcd28eec258a8c8fc39 Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Tue, 11 Feb 2025 15:16:18 -0800
Subject: [PATCH 79/86] dep-lochist-9798092
---
windows/whats-new/deprecated-features.md | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/windows/whats-new/deprecated-features.md b/windows/whats-new/deprecated-features.md
index f18324df51..c8cdc5b2a8 100644
--- a/windows/whats-new/deprecated-features.md
+++ b/windows/whats-new/deprecated-features.md
@@ -1,7 +1,7 @@
---
title: Deprecated features in the Windows client
description: Review the list of features that Microsoft is no longer actively developing in Windows 10 and Windows 11.
-ms.date: 02/03/2025
+ms.date: 02/12/2025
ms.service: windows-client
ms.subservice: itpro-fundamentals
ms.localizationpriority: medium
@@ -47,6 +47,7 @@ The features in this article are no longer being actively developed, and might b
| Feature | Details and mitigation | Deprecation announced |
|---|---|---|
+| Location History | We are deprecating and removing the Location History feature, an [API](/uwp/api/windows.devices.geolocation.geolocator.getgeopositionhistoryasync) that allowed Cortana to access 24 hours of device history when location was enabled. With the removal of the Location History feature, location data will no longer be saved locally and the corresponding settings will also be removed from the **Settings** > **Privacy & Security** > **Location** page. | February 2025 |
| Suggested actions | Suggested actions that appear when you copy a phone number or future date in Windows 11 are deprecated and will be removed in a future Windows 11 update. | December 2024 |
| Legacy DRM services | Legacy DRM services, used by either Windows Media Player, Silverlight clients, Windows 7, or Windows 8 clients are deprecated. The following functionality won't work when these services are fully retired: - Playback of protected content in the legacy Windows Media Player on Windows 7
- Playback of protected content in a Silverlight client and Windows 8 clients
- In-home streaming playback from a Silverlight client or Windows 8 client to an Xbox 360
- Playback of protected content ripped from a personal CD on Windows 7 clients using Windows Media Player
| September 2024 |
| Paint 3D | Paint 3D is deprecated and will be removed from the Microsoft Store on November 4, 2024. To view and edit 2D images, you can use [Paint](https://apps.microsoft.com/detail/9pcfs5b6t72h) or [Photos](https://apps.microsoft.com/detail/9wzdncrfjbh4). For viewing 3D content, you can use [3D Viewer](https://apps.microsoft.com/detail/9nblggh42ths). For more information, see [Resources for deprecated features](deprecated-features-resources.md#paint-3d). | August 2024 |
From 6ad23695b9ae767838d2030fbd1b0a4795ec0a93 Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Tue, 11 Feb 2025 15:36:31 -0800
Subject: [PATCH 80/86] dep-lochist-9798092
---
windows/whats-new/deprecated-features.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/whats-new/deprecated-features.md b/windows/whats-new/deprecated-features.md
index c8cdc5b2a8..b9612ab0de 100644
--- a/windows/whats-new/deprecated-features.md
+++ b/windows/whats-new/deprecated-features.md
@@ -47,7 +47,7 @@ The features in this article are no longer being actively developed, and might b
| Feature | Details and mitigation | Deprecation announced |
|---|---|---|
-| Location History | We are deprecating and removing the Location History feature, an [API](/uwp/api/windows.devices.geolocation.geolocator.getgeopositionhistoryasync) that allowed Cortana to access 24 hours of device history when location was enabled. With the removal of the Location History feature, location data will no longer be saved locally and the corresponding settings will also be removed from the **Settings** > **Privacy & Security** > **Location** page. | February 2025 |
+| Location History | We are deprecating and removing the Location History feature, an [API](/uwp/api/windows.devices.geolocation.geolocator.getgeopositionhistoryasync) that allowed Cortana to access 24 hours of device history when location was enabled. With the removal of the Location History feature, location data will no longer be saved locally and the corresponding settings will also be removed from the **Privacy & Security** > **Location** page in **Settings**. | February 2025 |
| Suggested actions | Suggested actions that appear when you copy a phone number or future date in Windows 11 are deprecated and will be removed in a future Windows 11 update. | December 2024 |
| Legacy DRM services | Legacy DRM services, used by either Windows Media Player, Silverlight clients, Windows 7, or Windows 8 clients are deprecated. The following functionality won't work when these services are fully retired: - Playback of protected content in the legacy Windows Media Player on Windows 7
- Playback of protected content in a Silverlight client and Windows 8 clients
- In-home streaming playback from a Silverlight client or Windows 8 client to an Xbox 360
- Playback of protected content ripped from a personal CD on Windows 7 clients using Windows Media Player
| September 2024 |
| Paint 3D | Paint 3D is deprecated and will be removed from the Microsoft Store on November 4, 2024. To view and edit 2D images, you can use [Paint](https://apps.microsoft.com/detail/9pcfs5b6t72h) or [Photos](https://apps.microsoft.com/detail/9wzdncrfjbh4). For viewing 3D content, you can use [3D Viewer](https://apps.microsoft.com/detail/9nblggh42ths). For more information, see [Resources for deprecated features](deprecated-features-resources.md#paint-3d). | August 2024 |
From 60df47a7bd329c5b6926e2bce7e5df77e8142d1d Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Wed, 12 Feb 2025 07:58:16 -0500
Subject: [PATCH 81/86] Clarify RODC support for cloud Kerberos trust
---
.../security/identity-protection/hello-for-business/faq.yml | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/windows/security/identity-protection/hello-for-business/faq.yml b/windows/security/identity-protection/hello-for-business/faq.yml
index 8b205bbe9f..f133b4dfd0 100644
--- a/windows/security/identity-protection/hello-for-business/faq.yml
+++ b/windows/security/identity-protection/hello-for-business/faq.yml
@@ -210,9 +210,9 @@ sections:
- question: Does Windows Hello for Business cloud Kerberos trust work in my on-premises environment?
answer: |
This feature doesn't work in a pure on-premises AD domain services environment.
- - question: Does Windows Hello for Business cloud Kerberos trust work in a Windows sign-in with RODC present in the hybrid environment?
+ - question: Does Windows Hello for Business cloud Kerberos trust work with RODC present in the hybrid environment?
answer: |
- Windows Hello for Business cloud Kerberos trust will still work if the client directly talks with a wriable domain controller or talks with RODC which doesn't cache credential of the user who tries to sign-in as per Password Replication Policy. If the client happens to contact a local RODC and the user can cache credentials on the same RODC, Windows Hello for business cloud Kerberos trust may fail. In a production environment, most customers deploy KDC certificates to all domain controllers including RODC to support LDAP over SSL. If so, the authentication will transparently failover to Windows Hello for Business key trust authentication and user signin will still be successful.
+ Windows Hello for Business cloud Kerberos trust functions correctly when the client authenticates directly to a writable domain controller or to a Read-Only Domain Controller (RODC) that doesn't cache the user's credentials, in accordance with the Password Replication Policy. If the client attempts to authenticate to an RODC that can cache the user's credentials, cloud Kerberos trust authentication might fail. To mitigate this, deploy KDC certificates to all RODCs to support Windows Hello for Business key trust authentication, which is also required for those RODCs to support LDAP over SSL. This configuration ensures that authentication can seamlessly failover to Windows Hello for Business key trust authentication, thereby guaranteeing successful user authentication.
- question: Do I need line of sight to a domain controller to use Windows Hello for Business cloud Kerberos trust?
answer: |
Windows Hello for Business cloud Kerberos trust requires line of sight to a domain controller when:
From 494304bf56a1ebaf2543dfdd150ae62104407eb7 Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Wed, 12 Feb 2025 08:01:51 -0500
Subject: [PATCH 82/86] Fix indentation in FAQ answer text
---
windows/security/identity-protection/hello-for-business/faq.yml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/security/identity-protection/hello-for-business/faq.yml b/windows/security/identity-protection/hello-for-business/faq.yml
index f133b4dfd0..3a5d20bea8 100644
--- a/windows/security/identity-protection/hello-for-business/faq.yml
+++ b/windows/security/identity-protection/hello-for-business/faq.yml
@@ -212,7 +212,7 @@ sections:
This feature doesn't work in a pure on-premises AD domain services environment.
- question: Does Windows Hello for Business cloud Kerberos trust work with RODC present in the hybrid environment?
answer: |
- Windows Hello for Business cloud Kerberos trust functions correctly when the client authenticates directly to a writable domain controller or to a Read-Only Domain Controller (RODC) that doesn't cache the user's credentials, in accordance with the Password Replication Policy. If the client attempts to authenticate to an RODC that can cache the user's credentials, cloud Kerberos trust authentication might fail. To mitigate this, deploy KDC certificates to all RODCs to support Windows Hello for Business key trust authentication, which is also required for those RODCs to support LDAP over SSL. This configuration ensures that authentication can seamlessly failover to Windows Hello for Business key trust authentication, thereby guaranteeing successful user authentication.
+ Windows Hello for Business cloud Kerberos trust functions correctly when the client authenticates directly to a writable domain controller or to a Read-Only Domain Controller (RODC) that doesn't cache the user's credentials, in accordance with the Password Replication Policy. If the client attempts to authenticate to an RODC that can cache the user's credentials, cloud Kerberos trust authentication might fail. To mitigate this, deploy KDC certificates to all RODCs to support Windows Hello for Business key trust authentication, which is also required for those RODCs to support LDAP over SSL. This configuration ensures that authentication can seamlessly failover to Windows Hello for Business key trust authentication, thereby guaranteeing successful user authentication.
- question: Do I need line of sight to a domain controller to use Windows Hello for Business cloud Kerberos trust?
answer: |
Windows Hello for Business cloud Kerberos trust requires line of sight to a domain controller when:
From 39d7a057342d5bd6a48649bb9bd366e388b07c6e Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Thu, 13 Feb 2025 09:18:15 -0500
Subject: [PATCH 83/86] screenshot update
---
.../pin-reset/pin-reset-client-prompt.png | Bin 59295 -> 143989 bytes
.../pin-reset/pin-reset-service-prompt-2.png | Bin 51382 -> 135388 bytes
.../pin-reset/pin-reset-service-prompt.png | Bin 53477 -> 136146 bytes
3 files changed, 0 insertions(+), 0 deletions(-)
diff --git a/windows/security/identity-protection/hello-for-business/images/pin-reset/pin-reset-client-prompt.png b/windows/security/identity-protection/hello-for-business/images/pin-reset/pin-reset-client-prompt.png
index d5c3416a676f2a74093d957e39ea3248da3f8eef..fffcd5b0f2e81700bf222b771002eaaedfe643e5 100644
GIT binary patch
literal 143989
zcmeFYWmnYS8~>{kg5-bdPL)XwXgrtD<(B0j2
zhVSpc&NDdcoEzr`u$bAi*WRCf#rwMUYeF^E6$zeEJbU!$5rMLj-1|q5p2R-p#8^Pb7WOPB%fIFEV*tSE?eoWv
z$>efK64KD`t~ZvIiJX15+s(+Xscrb>Wnp_~m|?uG?)Gu7uyp8mp{qI$eIT(6l;sP%
zmq{#>?2VM(<zSOs)W@G)7n7&V_caJ>
z<9qVdLGRZI@4=2oD}QVkTK)JesJE8?8!Kn`C?>_-c*-)d%zMgL@VNcx^d!^?M~<82
zBZ_sQlYqxs0(|Hi$U{tKNu=s9Pe?eCo7BRY_(!Tw|xBR>bL
zPVHV(efDq`I6RbdI3gWhRUIm0A;k~`qG7s03KN8o-ka}5
zsPzT?x1MAS7Hv;irq5IKU&1ACuTEzseP3qj%sxCJ;vA03s^zSgd=@st-Fh5=c-j9M
z1M%34ji6O*h@npNYD@pV@5cInClJU+v~AZ#$HwX<9h&@4SNi`BI4C5S}Bhf6Cq;cJxFH_Oj`b46tDvrf61Pqew;rT(o$Elqs-ba!;V`trV)S0ZKY
zs_N89_9@4P6yC-D?SFnI=l0frgwOOu&-Q4l#c_1MVfYkm_R6l7lO2;Z$@`+&TF*#J
z$SgCn;cz>`S*Yby?0iLK9kGZ(p2qyFFE9attF743cDwGd9Vzq(OlQZ6(WHI%}vTV=?W$p3qM-b`%PRRbdqH+t{?
zGN)|~?T&VLGL%7dH6diq*-U0b#$6FFo0ZLAzv7s1?`x`mccES3gsQ4nZ^dMZ^;U0u
z-^5}nw{s=_l{N|)N;+F*HQGK;5{sVNlc7S>m5-Qn^p}R)?bYf>>TZC5{1TR*_H*p+
z>$7wxV`5{5)SZS4%&jiu%EjUGEUAY0qM^qsnUL!asJ8V99ztM3f0VOk(&V)edczWg
zxV^U6CYbcl)$O0rl8$k#8YQ<96Z%ed07eB&dXSm?N^+<&l5o+UK*qWC`(s;lF0lQZ
zCA}!TD0TWzdoSH>&OwEh
zj6UI>A9QS$S>nw6=-oPhWMXT01&y~ZZ5nSn8BwvF^H_H=?TWxPF%O}3#c3~%5Wc)v
zj-E~UXt+t^u>uf6&llK2Zs=}YyIV6;Po@i^PjlLDIm%2R}
zwM8KuZ0lANodTW`5psds7sZSOWQ|Nxs6?F$^dQw^C=wNpML9v*Zx`8Kr(+)jCeisC
zL>vZ+_|3XpTs!AjJL?K-xVzf!*l*ZxZg_~LP}}H-t(SkHy{3E&HIn|oz(xU0|SFF)Phk_V<^!%q>&=cv_`YQ_g-U8
zQ9T(6xChdPm)4SP0bRXOHEW^E{0`)$6;U0^pRJc>N~+y=K%e^ad~1D2HyMX+y8bjR0X|V?vWyk!Xa$Wi#3mEkD)I`QG0y
z>~#sCPZ|~?&v+AD&D-Qj8BS4x!X;%1)LB_0(ZFj^j$;XeI3`;w3nNy*P=B!uk&K)0
zWV1ygJa3#N{y2s9WuY}1hF)ELht4;(f7@AT+T{;oftc+6k=wYG(l-9l@?2Ib>=PuC
z4vb&@Al_vNlHg+dXn86Jo*<)>jp6JFW%5hgqGTc93TjzNEu&7
z`IH5$uIYSE??EQW)yn#l;;pTf&RHmF#to=oV%q(V-Kje~T46bJODNB-rrPVqBpj}6w8
zgO*DW=iu<1DAz~=5}gJaj89>{_s-Uy7=M2-tZ`TL~?L!#Xi0wdc$^}y!#P9->>xyxuYBK1d#6}=u
zfF@kH+cQL-BqkUKnHPCFRI>b;!wUyo(z2f6)xHmRU89gA_jvoIJabu1X!bcKr5+hz
zudt|uqW!In>&2a|Qf6C1dmEPk$fkyNoP_0a0dU}o1fUy?tDhRS(k={+dRa
zaj^LDABo8%I{||9LxN)6iPvksrrF!5TjKlw0}>tDH9~%jN#9T?qWvOAj4r8monXIM
za?fMk)_uM%ud!rP`@NpAhNoSu6CTm-c5}VS=UTh_!@;H-%2Jf=VXvP&Gnrgl6;Da=
zJgQ_~=2}?jh_B5AEdPE%5*taZ%ZIA8$m5p|H779+N|uR8X_Z06cLoxUOJR~N5%p2o
z1@bI{6o{u9HBf)clQH3uIJ!r2)8%Zbnrb0xD3IA7R$Ff*vk|qKB;z_mRw-gB?1vji
zXdg#qzs;d>Le&@wDibv$vMIs(imyGN1A-+E1aVZYgdW?l(+Apko(g+Zxcxr18~=b2
z`cNp&65zhuPrPf@d%^AXHI4Fk=lS{7jgJ9y(mCSg-tW5WdNtrd;-47PG|F4r^$g#E
zhC$lG0-W2Y7^v?-KEhs?Dn+5s^!ojv?MKiuq)aHZog%bV8k6Uq2oN&H4Uu3E0OJDU
zaM&aiRsMRNv9r=`Fsw;6QR!t>82
z^O-~FgjCmg3}@dq!n_t@CGol04$X9j10j_pyhh*FUzZ#OPZkDUzwD#2HPx>~L;-kl
z=mIH#H5V?vI;dF|88E*oWx`BGgibqO(dY3(i@@w%Rxr2tOg|NSR*C`exZ~C)1-wqS|%vfAC
z6m8T=DkGSbhy&$k;8HuS&IG+jnzDU1xga
ziI;c|Tr-N4!&%I*IK*$q{V05lN!bZJpzFoKI}F({?W5LBq&&NlMaDGEc6}>-Y8>}%
z?KJ}mEy5S+pvz@`B57_Y2gPJsM!MsbHE#wgqg
zOa~izrf7~wGWI02T*q*aEDul$G3&A5s8v4BL~!dI~N#W?i@fMh{IlCDxFe;Okw_8Ln?z<
zEL=;UY|J2jY~@6Qdpsz%k5Bp2)Z8pjXtTU7yFUT>khHi~da`JIxcuUn58!)-
zO^F%|?C^hqj0F<{Y8>3xWI`sJBG_iVj|XJ$CeK1HqYb{@*p`5V}MAy>(3;X
z;+AoZTC6LP2>a+?L3vH0u~!QT;W&IUBD3Z9xF~5=oKsYHs_l
z+{;96Ia1wsgNkL7CTZ@5bWaF|y`1`e?&R%pbalnzn~pC^``1T6`7
zxy=}%%b7Zulh;`B+h)!)ZyIGOpfqsEt;Qs!|@c*wAW1C!@N
zs<|WoFfjJgH62lgvz7WW&4MV(1DEnGnT2&fdEE<6o+;{w2*mLlryw1byg?Lz(A*?~
zMZo6T>uAm&IA(e$riZx(H%Ms@V%q(;tQu$bt!oE|FekL3L-%B0wPz8h0aQOhrDRFb
zzWlShUf1sD7bqawb$cHcDPmQQT&3$mrpf1IFCu!+Y%`%jp!wGCpv&5+oZER;KL-`GQf93Rhxr8Z~hdu;?50-6=+c(4rBf9v9BO@F9;p?iUtdA~|0?2hrjIN1?=b@IX1)r;ekuyXRbX0{#S
zugYp^zSkctCmn2kw!f;7OqeFAt*B1Bj*+@Tn%9JbF6nTFC4OX`M4ZSR!TN~oqq!!B
zBB@Zi%9`qFl1_%GE!pz-gS*&K;;l(r6oUjturvng(6BTz()<1c!9lC#bjs!uslX=f
z|8-Jl0}NXrn!MY-d{jjNfRF?(qEGg{_#6pyZ>ACvk9{oqN5XvctN+CNSbSmu#6d6`
zgWg{Q9@?`xUVpc-RzH;9U)7rRGC0v*4_x`;;j~w@{I6fQb#gUEd#k7W4imGu(nvcLdm*lBa!
zlgDZ?f%PoH-H4l1H<6fwR5#_IFN1ddRXW!-%{`2eu}HOI@RgJ8%dIilxpL>`dJOO`
z^4rjrSn1tS`)h3$Fyyz5n8tlNFyT<-uzc^mR8we)<2@dIJvW5UqW{IVn7?#MQmBf=
zE6X@wiuqu`$$5^`RuGI#VZ8jJ_GBMy?20vlVQ*&@aylKnp?^ffd;DeXPQ#a6<^VFgwqIDV7qs#6)MZKAUwgL*d
zt_LzuV~XEJ^g%0fmgQwin_h|it#*9d|1&{1ivwWzkMOv?$9mZT0iIwI(H7_p%v5(9
zKFq0teqE_f@tpY3bU!-r96S-Od5bsPw5j9ocy+Q_!ai*Hq^SS9W~cuIDctfj(7Z_A
zJVv0PXLp9QfOUNPmh+PexX&!{X>J0fLgzM?ILCT~9W&1*th}MYhE*@H`nw!Rxuc))
zqW@O_28}
zDliG^zm|}Q%(el6eej>-s-qpdp0%k=
zkATi}=GZ>*=ZSz=c_OF7eXGK%P|pcm`g*}81x@u7-n^4KaJr>8eD3XgmYpd7D#7XB
zZv5uhvz{0}sjnIG4MC>`mYbZ%dWz2u&RB{Xw{IObZHn)jA|
zoivAgnq%KvY~^O?utl+N&o|DeDr;0Oejs2h+SMV0Qgascg(3=;`F^9&b3b~p!M
zZfYe#KE+$;o$lN*()5$u8o{2qLAb}iq9lgLAb~+o;KFO&-p2Xq01m)&+P-Uv?bMvI
zuy$)^c_KwH5%=c4d`m(eTeN)QChr6~aIiG>%7F6&I7n<2Jc+qT3{KmJ#4^tHz(u+l
zSlJw4{wAi6!7^e
z$F#?IcaDA7ptZ&lFPEpVKq|x(ymBfb?_;U^f+SJKnf3}{sFdNtrjcvzg4o>d&G;A}
z47We}rV^qR-wnU{7yeVnERV5|IayuhDz(uuBAOf=ThD90Rk=}r##FjH){x(OdD_0A
zv;_u-W4fc%i$G#C0k4VRr%@k0HVWKq4R6w|vVk&H!G>ZXyrr@>`|ihgC2rrYYI6w1
zhu+1SJA_8p#=;S!-Gw+y3QHVb@SjTS4gGItl*Fuvdc&Sro0{LNb!!bhnS3{5)l)Au
zviUo84emM-)6UDzd3gT%H1*CfUwyf38_dY*O)qzzi#{+IfbDSpkahbeXZcX%bcy|0
zi)wuz{&SB*i(3O-VvD?T)tlny3i24H-i-+kz&ys%w2J1L`C_iPC_0U-1Rwhi4jwK3
zT0WK{!!Z3Gut^o)c2x#h8Qai<7k5Dd5A`M9=Za-i8Jt)(UtVfbGs|l
zYYdmEkR-UTX?@|?Z$mLiUvd%5w&=8dz!6sK=7BsnZW2%2?FcLBW2AOVsF|Hw(!5W}K^Zr-NBtbLAaZ7&kkS{CYgS&$sDf-PQWS!x~3>
zJGt*<1~8%4@oR}&yQzB4cXp!9IikH^XVCSvfnSa!gIY?Xv%+22UXenH9n+q|F=}i&
zfH+68X<7z6RzIOc1@0bQDj8b=D-}X32XiDiNsCGLJoxz@jg$JAkLq+mrtnWWvdlNO
zWZL$I6sAowh~IgUPscIf{m#qY*l(N{O)VK=#ij2ZF2XcdL}+c{cAh;RVXQ+kD1d{T8ATv5wMr=(`ccl2j
zq{qOx;*{eL=J(JH*;0e}(K%-e#T3ik*Ny>#u({W((^^G_eTb97XPK`ZbREzFgN?5s
z2_OmXrYPR_JZ7i_*2NS2Dw^ds=j`4T9jq{N<@ebArE~5{)?1^6_S;_*xV?j0s-uT)
z!41Fpka~uqq9Z2yIy-{zrt5W1KmD|siYJ4o8)F4~?v_;+Ys;UT*obg>DiyFM_xA5X
z1P;Y_PxcR6gg%mWAj*4Y!|%yb1Ohg!rHosbHV(JGmpBLw!nVHmuJIG8!k?4Vqf#@
zyh0Nz4&BU;;8Gs(BENcDXA8a;yyN5A7Y{>CY`RXsg>4lcJqNGV7vcoN1ygkLEgtuK
z5i4a*#F&)C)bojMefzS4KueGZyP#InTDR>^efg-Oo#U!u$IiSMvbi4#{ZTbJM0$U?
zU(D8^o7fP;npTJ;4UciosFYLv)M}Psb%lagsCLH@vQvN5P3^le=#-et_)s37FK?``
z?y>l3QvP%}CU;cx15vS(WlA&KzPn{2+7fxtVzQrvNj|{lMsNJ|Oix!_XEXtw65X}F
z^`>Q#eIDLFY)u*46q>nQ56wL}ui!f3_t@-DwH%-OV8sny2UZW~*!QKuCgw(cyZv8p
zH^MI}?;wu##eO->I^#^wFNTQ*+Lp{CQUSlA|r%
z-D0wGX4OSG^1_?*91#~@iRMB+jeNgHy0#?n|80kawZFdN3f%aHCLRK#s1RXGz1#eH
zG5HMTu+t``=em)s`;C+DM(12Kb=U;I9>SA?d5@2lOcN8~^S#f0!0ik3E5U{F=1n27
zXZZ!F(VRE4-zv9Qw^Ij6R5rysH#K~R#A?}gJc)31qH*axvC(>_>$!`q$CI)!B{nCY
zIS*IcN^1MD!KNnB8}W&co^&-%Gb$_bf1KERv*!F$UwaIxc>N6Uk^8fMV<;hQdn+!YZ4fqk8%Cf4q|a;7zd2Xb3RC#fl_w=qY|p;Pj%IE(99$
z`A5d7gT3XMZs_@_SIl<4FIZ0w%x+$p?#;(grleoxNcV?i^OT0=6Z1+@ys|E(Rc@p!
z&||l#SN21y?mv0(*6c5ZaSUm1A8$k53-Edkd1O^f;Rhf0KVC-fd_$t(zVvd|8#-Ke
za^`cb=@W|rraXNlsvhk;DmU@;`>4kGUQlr1C+ZR3+Ued&93A`zOpPI;&`GK&6{
zR38^2c7(X-Ljndt)Nlrf^*G89a{9|?3TmUEm)0QE>B{LR6#sk-on?gnxUQM0wFbj?@7B@Zu~$U?)$
zVaA*t%2K^8B)}QI-AM3{
zRj&fDoBs?jkg)#XH5?IC`b#q(e_92(658SEdyaX;@d@lZac#h_m=Y2n^(DaLTyGeo
z;=$Ui=i^Pi-pi1MtNuJR_u0p%2yKZV6Ov$i9yFZsPem~`3K*yGlH6qYgFpPuR)QCq
zo5kEdc(Xr@eLIzbiD5e0{h6|sS70H8%}0Is5WWw7km{^WBQjQh{amVC*sK=@a{!NZ
z$FNe!71)2X23FkF%r99V4ffUN<5P>+yVRH$6w!ryOk~9fezYiY{`tQG`Kz=Qe}mF5
zFvaE%%DViXrGGjbIPCI8*zFbQke(<~8$l+hk-Kj2@wAphON+bMqkGpA{981tQonG&@Y9Q5?)We?zmpt%p7
z-Vcz<<=+#ZUF0aM-Iw?aIB|xXVzT%9Uq!mcBj<@*wPT;s|*Hl-F@Ko~s
z*UoAsUQudLXKVH0v?SVP7w9cchVu~KF6?mXR$rRPwQaB=XEieZ8Wz*(85{2kz>0U
zM4qwhy?wk(aaB(K*?X9Pg1?8eqKAQil72cIq{>S(Yu`bzhrYDOyG1>qLs53+oxr_T
z3?gUt;;Q$*-&E3+NL_6(o-c;bV#mA_c~A4e2)!Wp`2X&f970(mJX8%b`6x-)k6*-zxS2`~wZpvo9UGL5U6sfdG<6R9of-^kU
zUY?(~+|NGT$Sf`%&&=Ps5^EV?_4Xr~6kdDOh^<{V+>V|{@Y!5rh-L{Ks4T*2#ecU5FcH||
z@S7XW5mt5*#Sh?dH!j#V9x6OgJ#}a*P7n&m0)krAGQ_7`m^lWZ-F$<>9k)A{Qg{j^
zbiO|oA|27RxKkf@i+8euCN^mtn&+`NSTV9`+eUr}ggc3-OZiS3htxe>^(U5qdcre8
zG0mUZ;-F|`LkJ1diTnY^#zJI5NHpLW01H$Pf`tt+MvIe(7NCFg>T7hvfANxI`i6PUFhn
zDCsI;@=W77QNzJl={EuQ_sJh|;tAUEtWl8KSs;=r@qI7e3(}2=`cG2Emkp=mdL17g
zBbiz_(G=sJcIH+519cG)p4vEko?zY{h`X10e}ir@1(KpB%S}7%s>nHF-M87uF
zMoD=7gnDFHk(OGND&-=5#wulMvwbSt5o?|1sc1TN}6j%)L249q{#pZ
z9@HBUvxdlO`~vnu@UoCT1GHf7uQa(aHCbXb2BB~(q;f!TQ7GffGVXG^IT_D6-sv@3
zT2Dg|i@|M2jYtxefBLhjHFTa7Ab2vjH=0z#$_{)hqj`$0Dy)UA>V!tG$~1pmO9lTH
z{gv+eY1dAF5fKhh=jhq&rNQr_?_wlvbDsizLBnVp*YnQ0c?I1=$2-Osh9k?rHd2%{$La03VEsV?%SfQ(ILV+UCN@^U9M#oS#REiU${pS=oPTwsh$Q
z8UaOMpf3i9Uvvs@W26r@s|7Njia0
z%s@3yAwqEk_LUs6qE{v2rduDG6B)oskhsPR^Zq5&Q|xB&soX<5c{O52D^lh}8%9j(v0#B;2-suq?JH}mSuOi29Y2y~h
z2GzHDhvSWf)z|8xhIj6pM{2e5TZve*!JM|eIdj5B994g1Z0~Q+iRRMW
zX%~gnTA%au{yBSQj&D+wQ&QuuTt!r&DTu3KP;(AM6TeP}&+4nT<4rlXj7|837&Ly^
zOj_ssYcJzu-}$63(63?K%%YKLV--l*71e@
z{~mb0+)f}9phQBg%jy>fJ>lB$4?&bU(sYJ->aDS^)JSqvX4!J1MKKq%n!ckFaB+m8A
z=!}h*DWW6}S}~0Ma4%UUPAt9q+Y`vRf#U7C_|OnxW#8eZ6dl6D;2C|(T`UCcPFs!6
zoAY#!{oF{z%3Cwd@)`#KLwEXRRjb9M?Cjr_w*5M*s-$hsFa?}fCt!WRjw_G78
z*H?PI$CvAwrL&e*0`L*{&;q-oA0^8SI5T^S>ym(I51^v8n`X5yV3rcM7f3w+hNWal
zeYAPh%Fy@rw3^in+iaoBf{fFXk&*3C+s2BF^UU)*nK2Gwo;a?q{a
z;f%tRL?j*8$^RnVX~S%iBB0oQL$zkkbGwX)DL{(76wGnF5I_|C*k9dfHQ^)S9<~0N
zGk&7$NS`ZlKW9Z$cvL2NMy>3K6>Ra0spE~7TIf0gts
z)hV6)|6He7X1rYUWMojrXixB5x0`<1-6Peqi&mP(V|+P$oX?c`_DrUwhzOvxR|FiH
zRiCHhR;A`7In$qx$cdEM2PFK1YDWPGS9`=Iwth5Lz5nrdyk9i50d~#SwWsAp7h!dp
zw&m=L7I)!61=`a*IV3zi5^b)|J1_q%X|8Q(Yv`7|oh_GQagxPN63xFulo(P^Fsd{D
zDSnt7Uoc($m}(w9qXySQjgwKG#+k
zVLqgOyX(#EO)`(m{E(QJ#FnP_AB5r3(=>Ym<4fs6*Z%N?m6{n_JX&t`HKhRB0@8gF
z6?KWzf1et^JyP~oOiZzupJM)e(N0cs|4&MB>ia&GW%xW^$_iR5r~MSaC3SH`0u-4Z
zl+Th_SwG@}%KM-#l-Ap#Vcg9ql>AL7EtK^Bd8St}xnw9gUZuhI(@rzApTg5+FW(RH
zI8eLuq~C0PYO!8fSny>8er=XO@-KstvOwHfXXDc+ZTp9gJN
z4T)LiJY)6UW?d>1+^B5%%)yDTA&2GNG_c)IN9UuNcl?Lr*{BnbKDUbf=IdZriuJg9
z=u8qhDwMo3v=$yx10(Fl3qa!iv7bXLXq{`H2Q&)8$6`S10U0Zps8O~|8&|k~Bqco2
z{LyMVN#9W!(S;W`HKL5lO}I{TO>G{RDq}K?A4>elZ9~HSj^v&=)_pkjC96+9c|dlf
z$b8n|(wQ>tHf@^B^~sV&l>HadlWfB(mb+}`Ln7=T9|y3~=wUZ)rn>`a`}NgC3(d3%
z80r;7ri(M-X(#=HwMT^!xhj3@IIp?)&sSHh=4drTWG&gWy$QHX``V(&R5Bh$-k-OP
z&{`7QqkR*5f8BDga)Y5#Ja{9k&*1sALNk%>8-of%EzZG*P_iDu=+4ssok!=nZC~xB
zzSpB^djyb1qbsdjTdW8>1rfm>rn4N_8C(U5F;T(S@C1Eu&*^6985M^e-J$i!vvHDu
zU(zbH^PwU9sbYX4Ca0Y!ILf3LDnV)Zc
z@ai32w3lBK?w_9nML%~(5;wwy)$fl(q;BX>G+ceFo*Y@;0xy}G2SGoc>wPV@(GWjG
z8YS=_+-b7JGg{@V{^p+JSGfFJ(o_ZqPuA5IN8!?17pkfJDO%PA>BYq>J}VLd+Dy~h
zYn&t+Us;VhAmYYu_Y4!q^a5
zPb1YQ!OyzCJ8$XmaDK5VJ+x%GU}lIPAjCx_s%Wb(>aFi{NTu#1z+1LZ*gl4QBzKV;
zFc?DcEi_4ba;=)@dzqCOL(t%}B$lN%{Z+*73prvDxZ}ExSzr>21T)TLaBB|v%hS~r5K`yGJp9;;KRO|R=?c9T37Jr#)UGh@jr{6b6)h57X@F)BQGLGqw
znzpB;wm9+KnotX_!xW0S7bgDjor-Mz7gTJNs8W1*6%mp-?#fCQ5meb5OoZ{oMe!nV
zx7cdW`t$Xt0+l26Sxv=%co+=keqQ1H$o&_#`RL@7&pG`8CyVBVFrfdeux7|-&uQ`7
zTg?##E8msJwS1d$93xie3$f4>qV
zjk_8A5XJrNFx>bGiy_D>Kv3h#EyEn*>qHN1|0)3kd4!v5HexyVS39|Z-lSG$vzLRS(cW0q`
zLzjF(DTz>QWTrpVfVQPOw?2N#WSBgL`iPKj+$g9ku*W*64O$iJM-us0*1aX*o+g>6
zXKKd4UH1%EwHN4KaBK@|b&w*)njqy`H*lL3IKTGYfP*fTsOq^Rei-{x
z`(r>$(CX9Z74$a>yQ8EQeJ8DQqsMs9fPf6_
zsfFu?`CD5HZ;&9m>sI_+OFXqOqxc!H2);*?oa)?H|P$-
z)29<3Few&B%X&+^q?6;oaI831J-xcH>M^3dwrS!3yjTR7-#;kUabYvFv5Wo5wqIU5
zydiN;oSa-^yWC4K<+SE$!<_E?8hEzs$NYgz)fCc(*O^us0whT?h(hLKmGR$csc_X$?=VC6zIo`obK_#
zh^H>uKMC}0t!P6V?F)9YaY_z%l-oaU;2SuoMu7aBFkHAoP=m#LPkEXTXwkmab8Gzj
zT=(QLTBvHgr~If*2;x~T{#?+)Asnm|aqLT~e0sK=gMF7f&Oq
zZfi3H^hSO@){u;-iXK=nZ0TSy;t%ocVFi9O+R_+rhn=z1jK8m`a>x?@($c7dUt~wI
zXL?1|8+WELv;O%CgX7T2i?X1
zwtBN;TcLzK{z}umN#+iOLd9OK4e@m2+n2sUq|D&d2D)%Lv*6<+64jI@uiI0?V}V%C
zB~<4c1$*dHq=aBWd8M}+HX&*}np$b(ctFgJ
zzngu3D*9g6xO<72i}YF@*6Pw}1l=&D`^l-Pu&EZzX#iDN69i|BroWLP6MA71c8uFs
z!()}tQ7LBt?yZtHnj@z*YRw%ueyebu?Y-l@hY`h?3r~ANC-Rg&a8mBe)Xm!wjky=C
zBd35QS}wV@jOnn;D1Q;Vfs@B+)q;nsZ-%!&*h=qA+iEINEh2c)f>H
z;58j2@mxy*k*lWK1rci2Nby8=aNa&UmpT_d_gAwkJBIYVVl0g+l9cOWAN|cvlkB0%
zH>}}~3h!U88N1tTetV+N#DW
zA|F6jh*!&$b3mQH4x`4$LO`jK0h0K)PdgSOvC5&7B#)s{?&|Lw$B6E`^st8O=qU!C
z#qPZjwtZ4ROyFA{%d=0Q!m5G3M(fY)c>nH>*v=-eJ=bw06&PT%E2G$t5*Gy_fz%uU
zoH7B{xBlG>82U(w3dgBdEbGL}2_H|@)Xr<%j6
zh^(Ur63r`Tvg577|Ai*dGvE|a%lL`gmm)oweXG0%Yl|(*x~3Tj;b~B^tVZJf!=4FqNdI=y!
zML?+{MWqD@2m%73cLgbiA{_xkN4n0AznQt4e_$@W@!?5M_Bm&-wcquw&r&7uV8AgO
zI`ew9nr%tpdbP#8sJ52UA}*GFce)%TU)7fhpDuRvZ;OzW;vy0WRy)SexX-=?50*Bv
z|H|i?LkDd$TdsVicBxGHyA6NmIM6xPF0c8D#lqh&N^;q1t=hj5*UCyY@H_e}<>RG;
zsI=Et&g^$$ob3dgRcI
zU&qeJIWG!4m4l~7kar2Y53=ef_hE%4Ia!wE=DXNjTt!UVKiLuW?a%4=c3_wW&c59-
zp-Hwt@u41M(A}Z&t+B@~dogaLj@umTuv&z5zF9E?m?IGgGdfhM-@!@`u^Gs2ts&4GA
zZ}dq!k%hCm>u!CmhTW?PYUr(&BPM3w1Ei_-Ihi$|*YBtUl8%5A`X^
zpOX8YpJC;AuF^v#K9hXHovY}~s5(!VquGvVFVZT#-bHui;iF?wJ|Tb9Nc>2~%cLV4
z?}B1k?vG{mssW|ckB6>l#*THYH~BW^YankCL33o<`bJ_tR14O5Y3(Bm7Amzyd2zQq
zt}5P;E$G=l22!=4r@ND7FN`l+ua`lAtCVr!HzAvlA8FkaYI8~RYRL%#W*H9A#a;V$
zXVn>S{x+}s??iD_cMpTIlgLeJ1w&I=Pa6(
z%}%Sd-tfI94wW7HAyqDZtatH+A-TVWJnjaa5>rFs59M0U+Ob7+5gk(HDt_rIM}aUC
zg>uS)X$wEO{nf+TK+P*9412|vB!iMG^!#4y8A{RPWwSKXvsuAmqa(M>My`gy|4K|G
z6?wQaa=N1^db(4bpDU6!1Ug(2%=mxTa(+9WtbME-T}vD2_>FgtTO6|ZK_VH(Wwi{4
zEXd_gCM!a`9mvp!!UT>io=Oi@5wFc#m_!=#7m}O_FmV`70;`Wh!}cTW#4MICV4}e{
zUA^yK2++b4JX18TE#GvmRa~N+63e8YEe1h-r_-*_X|Hx>)l`rAr)*vnE$CJ~8|K%A
zyDjMuTD^EEwY2;kENfK-AvgZO8zn1kP$K2$*4K-d%j#S
zcWfue#1Z#>%%NIfh?uGnclw&qyZoG>?l=0LrHNMFcOKa;V!#D({KM;BeN3S7#IA(g
zKbiQb|HyfEy7H$Z^}Yiqo8mX_p
zbULB*%Ojaun!I`u4G-fuqcX5oN)FshL#S=-cX9)ID&q&M*K%Gw`iPFDMx
z^th-=oAIoAA#y6OmUKa}ygk3JS2Vfl4WGW`2fOt#C|7P057lPg3gY#eE4AVKdY*ki
zBIy26a+P&o-P-RnWq0kud_xvzI+v_pnX2b8vSR81eL?HZI>zbq9^Bo620>?6b;YIM
z1OE}Ny_1Z)Qp>bTa7oGJ?%_YHb$6#g*Pc->6p2;oD3^^m>Es$|0Orl+ew`hSGzgAF
z?&>!8%vjvWvmn`-n^TYNI5vg^f2Kx9iH(j$x!I|*%s6KY$CWv)J^db5!BfuiVk%8}
zzYmq&k)IExq-eb%K9x=?tA4+R;%gJ@p1Kdmbxh(gGLddtHKy#;1)g!_hK3(BTy^L7
zv>FkZjMO2cx;|5y(Gf@|{_frkBo_tg@w9d*j^m!Hl}}`xYLFM8nt9M$^|3>VR<6op
z?H#s3%wqDZ`4M54f$G6o%nh%+mV-oQr`37`ZMx`Drf2pvt5L;Id*gi_x%Hncveu)y
zA2+EPu~yLR|(mLIe2l6MupHR5)VX&VmNO=rj6`T3LpIxx-id4ttlK9
zG~ynA{5`=r-KuV3{ji_Eo>U%bP-;{B@s{v?0`pNV*e5mm3><~Iw70TnYEq}Mt4;hWG
z2sR)irKL~~gafQA&==pNLL`srGI{0~#`3{_QyENZslsxCICb|{T|3#6eOZL&K?avo
zS-zO&VQ*henwW@%#7Ox3Y_BYcCr|rvxgFH;H~|F*prKXBqK`k*wOMyt3wLdnTA`>)
zUkGUkPyO8|1b=x1UVCj_c-_$K5
zccU|us4zn}QeIL;Jp^T_VL!TO;oBnfn!2Y<6Bdlf8LI*1F#9*?eVou61~DhcgezxE
zcBvvnue(JpGVcr^AC?XMl0PP}JVeZRj4Cfo6yoT~k2#dChjxhNsTE{IV3p@g^)l>Q0z*l$;1+7_=nVA^Dlm^NI|L%
zamL)xh-Kb3gI}Y*-|+R57egm3LA*vVv_hce2g}!vaY>U)3L-`EDtq6~2@jJ$)DQMP
zzjiJRNBq>ZDt@VfJVkyJ%!6xwwFyc*ik$f7ne3RU*6`3?Ys3{8t_w}W*L^s98XYGosNx8=x`
z$UI}OY0@W4PA%Nh4(QEM?VaADes9@XEW`$1P8&U_ajn)jfX31(+KRPk0JuEfI<#kq%#(yg2+45Pa6~0d>e7!G=l}
zFD_xGqI}uDXyGyD7>|5Kt*5-2sK84gE7IE6mHM
zv+*zXU+l*u#7!4_H|vzaP^mB_uZ^ouk1f(H`lxZDmPF6`L|BciHf|=uB2ayU{aI
zV?7CGN5J1&oI`lcKI#i!YmIQqC1IN4=DYj71vYWB`j&P3o;nt_PfU4<&AvCVjJi9$
zUETpkfj24Re@>YP$%S89>_$b_h{QuO8aAY2?qY9t$DdO_Y+23;O`=?gN~G?e<-tjg>0EZP16t_TlIB36_;k2#e{_Y82){YYZ-Yl
z({6ur1m@pe6vohAnKU3#!sP{kn!(>IbYy79O%iUsX4FYznFTvz8xF3L*8I|u<;cl$
z+AO{}huj^0JUL%`2Fdw=nQ#0x2GjU{@T|~CBcb2eOBk{oRSB0(oNMT@Td@CPrzyp8
zJ%-Ap$D)cx(LVpyvRnj
zzcnf=v$}NCPV6*tMycEBTUV`JOV#AZQQrWynCEnKE|}HJl+7U
z!wVKD7j8}#Q|L=~6vi~3q9vI0y$GL1?ygdF%)YB{@_G+c&|$y$#jPvJ`jEts1Bi%~
zwgN8p!rpz^hTj%#&tOOaAt6|b{cZOsvnnmvXVT@IV1LZWGHr{%13I;2(_Qj3J*Dhw
zSNWT$hNmn7*2>C$G^@zSl=W<)BTd$}!xFIxtT}Zu5^`!3q@Dq*+TdNfPB2vOEFXEj|;vAsLi`IT|?7sZAD&JxeNOyyPs=1hvPF^ioe`v62hHiGk~+lhCM
zmutzZi=`s|Cyfc=tpHn@s4
zPmTDhIV+hUoa48u--zSqt4nDQU40vLxb0%}TF)BpzW<#Uuzz1-lTf28(uqx;cM>8>
z-TsYRv@)12J)qaNzVbWpvFvw=d{3%<`f=d8;mZaVy28lvjJR8f639J@tFtb-j^&Gf
z5j=$`PsqKNF9P#7t_U-ciIOh?7m0^B-6`Lou_XKhU|MD=kAT{5s*bP_pC
zyRj+niia18^j6GDt@MHsd^PH3Oov>^hG53#k|=o;g1e{2_x9fm;^-K1ic&jBn@a36
zT`a*d#nD%NTXwBKs4ut4m4m;y1Q&MDTkdeW75^RP_3q6Wmuov6PIsNr`i6~fEkT~~
z{T*t4T1G$pVKcjts|+V==^d-rtf^1WyfHj;L%0W?@f5nEaTtaTOOTk9qusueXec*+
zrK`P@Ku@rDxD)pEXV-3p*Hwy~wBbiZS}y8~rO9)%YadWi*=0tG8s4|bpd)3D!uS8P
zH)m56#JpYRQ?sb{=M$~VwbMaO8Lr_{dh9f(l{=p6k-ZFfoU~+ONzzyFl4>2xB-|Lh
zG#q;UPHOMc^I(<*&jI!+vT$)k2bNDE*a<#z2AdRvpxX_^5DW$r4Z1Pu_
zHiPq*54E07IccD&EQf_X7+xGQFsb1(O>#$1Cek(@!aO;P^@)3hz9Z_>|=P7dW2o&fI_Bcl(EaPIXpk#pRtQuAgF{oMkyzdXN{iQ+mGV(u-;=h`u34
z0ZZvJyudZdy!y$iZ>ozZdmUGq+wo*yxM~)El9y2b>&(G1*GtDRnX3HpQnOVcs
zOz`|s5>{z=E-hv>=CXJ1iB_x%hurPbz}Aww2T#g6g&15Xo9-@)Dz<&EtVK|o>A?}pwy~$n~%~o4+Z|QG!KJ4IR(YbvPnJRwS=-gz&H8U
zBf0p){n$7NFxMh&H0#dy61V9@Z9Rw^Thip0kam?$el*EX5l;NEZq${(m^8sBsQssI
z3S;+-tN&@;m3)61lO%WLt88|1?#GhXpoI(nIh<*@ga>TO2d#H^kW6z_GsI&|ohZit
zTGm}BZ#?1FeuDN&hZOZXp1*lr=tQT1OA(BPRBD0l^RJHYKXR4-?qSeGPQswqV}I6s
zn@OvGdH#!%TiZwXg*M&>%>DnMfwD$d%IwP~u4UU;3xK~nKo4OK_wx
zXkEi&Y=3g-nlEm3aeL-fxj-!@j}!Lk0Lz;Kt~;|Y4-k-EE{ZI
z@KT~TAb8P66o5+9HlX_Xf-8^xsRBMH9%+pQ9)pS*pSH`{zGu91jeg6~?=rS5|L-5@
zQ*~E1U~de)jRn^|ZvEtF!oL0=B=s>^-6H!Xh38Zv==2%j_0nUjTv@OC-YmIF&I4EPrByuPggyv?xU>eimdNBa)H=o0
z<4t%evRI+8Hc;E2ZN?-lx|Xv{wo>VlXnXUSTJT3EOi)KWI+5MJp0I<7vuE
zUjCpQ-*?A+S*k%p>HK*VZrM=A1jBzovL^Ni#kjPAO~+=VCzWF>A1r)2?V9<(&42d<
z=(xNPzeu-GfMT2j7q*4xL>}YqyIW_WUA>;W{GLZTv%qMtWa9@7eFhW@dk6L;@5S$a2hKiRVU@i52xllzHC!?wLb
zSKiZUQcNh|$;EW<1M+5&U_sbJ$a4t_{jq^ZKmPpwILDI=m&|#G-c<<4x|fk^Bo>Z5
zjPe(qa!8ckV=wc;(<$+u?Y`zGvOmK7!CSA1%ufckT`M%+WIPAVuB^b6lM+X_#g5rH
znz9WN`+VYnB2xu!KC``
z$m;_SWb;IIcrJ+r@*nJUGuyJy3&kj%1G5c!26)kbJNJDs3}
zn&=xMYp7{%3TPgMdPP!W!uLKljaQ^hs=(fHG+n(1Oz~GVWta*YKV~5u675=@M)(gT
zYM$fihTw&07^Kc3Rme@Ac%ITtnI--d_@Kootl@bShFxMCjle-U2b@W4@Z!kTXQa|=
zOE$n9G6($cm*UKlWWvHzHKvJ;jzbeBHm@9SHc41Vl4@QE|ARgsTA{s6uaNNi^VBSq
zbQgDMW{-xgNp*apK#OuHq;PW#HR;Q01@9Yi`cOb`8O`jP~agJ%U4?HjdY%_RO$!XChK9
zzuV`bgF*p%3GA*s8VXc!PYOP(ImGq4_P9X>#GG$R&aRfWAADz6Ja)LL;>tS1Us{)I
z+Ob{@-(Boe`C$K9G{zVz(oF5zADxIc|GMq3<%&B-Cgwp=NtayF5x+7-
z(+Ze}(K3?4-s)B^QPXHrr3~gttN)2sEBpDRJpJ0~mnm*5o$Pw>^r3s`I8k^}jaRhi
zi=Cq3<{GU1rSxDy6Oy~ZoCg98hF@?SE$LTd*X}b^Q}nkeq|~szt_+0?AY`B+jhncW
z+lC^mfgpImVEtktN<^@w>Kc*jE$7Mkmm%)|g6^np^jH&iZBgLYwAxpu
zy4^gl5Y)HsnV-I*!mpvohL^V{*X9J?p|ITtwByM^)Y=7=`2wF?XgWkhYC;vnto}Iv
zHK==c|NgRykl&)CfieKrb_N0`9dC~d|+tN?G=jX!N}*iA_wo{sW2)G
zlmiyoKkXkK83^WGWtz=)h5({ty21+tokc)&pA)0Z_Rk8O{}`-dU)z=1&p`$4u`m8L
zUjL~``G!AS6`toZAuYjLM%vLoYql0*0|>+&il?9k6h|uKdD)quqdByp4BUS)t7F>k
z<~AZYgx0}Y=0B8;D@44)_y_o~xZn@lGZjEAuA9LlYeUtRp09=d{t&j^w0^TW
zV0>pSwcF-`cnLOkwzXu*UV7%>O!ZV9C!4c>G#~%;!l#XR7_Y2Kr0)fW`SZf(gS;K5
zs^A_6i=KU#=wy)?$fG@vt97&8jnl7sDG<6|RQb{k*A@H~mp`6n%RlXOsSE6?t!!{H
zG2YLj9fZvT`+{JYZyYabRB@}qF0YGckTVzTxqmT9M{te)-`Xq8sLjlpg?~T(yy)(H
zUHkA;#*tV^j(;78NoIDJX2KEe;(tt-ZfpYEwXvLhVu$Dco_FP_+)>XemS5YqdAw25xdo+JOIWkG4@Hx+`$osd6S5E;D6`@dtsD%?}2K8nD}?)_%p3Jr=#5ctu&VA_)ZtBEd
zJ-A|l#sq5M?ViCp+}o~bO(_dYjESDQMo0
zpwy&r&_Ihr9Dbbi$l+mc=GiV|m=B&d%SgAC`V=9(?okLn{4Hf
z{T4ahc@qFh$tPzw8omhhbP2XaZ2K2bt#gI`sT`19fO&r1<}S!T`|8zpk=n9@Hf<9u(h`_dwSeZKeX;
zv+s~Q%vXYs)fhTJwj2(%C1q;^GoV-hq4{?y)9KERf$f#}v@-kGYd#xy
zu8KNj4iAT@$-8S;I8?3#!OI$R<)-ao?98;~S!?vI{kj?FKDJ%r>?Cv`JgI(fVt_YW|E~1u6!FU3vB^rB^-k--mhFRNa4F&bu42ES>3^5@i~zx;q2~svw2u
zr*q>ZhpdM%B*k%TZ7*gTBnAfWnPVNE^+j{6#qV?aV&)!iRpS5MYrf@xAJ_1+3CICg
zn=%LUUmUY)BfG7jcf0Ss3Rus(_xnEYElaqNg;STydStp2zk;_9vg|587!<9)F|&~d
z4#8J?kHKJ*SX=_+8R$)n$fhSi;;BRUOMd&zMmjc8n@NxZKq9w6UQZFhD_~K=*;Z!t
zFP^Y9wah@fGAKWsgbH`oE9B*o=42C7MNId;xRkQ6b8>(2=-<@=!%hP){6BkP4xzex
z&esr!TG@Q!8a5f(VrUa71PIC9dFdeIhNY5`0tEDi*0%7Ucq%iu8=sG
z*_of(a+aR**{k}dRp&5b8)Zr_P#y2o3~PWnL>T!?;lD^TKpGUv2#V5hQTwsHn(0qO
z%Wns8m}>~ti9GuktA(HapD7t{47~B@PDl|LrJ;0fcG=z6R<4<~#SE$B!NxQ8;-&dl
zl{cw%n{};Qjde?m;AQ>Xw~BK~;#bwFHkO81RpyuV!3Hxm!Ex@&%r-Tb>g*%3z0c2z
zH-OukZsR_{%}f695dEYEI`ycMdlAyI4_EqVEnoex*aLCIjZ4~RY&dL-ip$)w4V)|N
z4LQk_?HFZd_NOO7<*(wpbC;_{Pa4-w_))nnDdBOY&yztMX!ER+Lg{G3|D1wU5QjIq
zkvt0l$I1k`1-CCdA+z8i+Q#e6mR1}Q7keV1*^5!J3Dqs<#jXFYUjaN<%0SiF27Y&6
zJX{}jRZ=MY@T;DN_BO~iw}ov_lkg`X7Cy^Xzn}}_UYRa3ZPT(IEL#2*4P3LfZ^b>@{*q+yX~lf8|ASLsS6%5__I&2`Wx$rHK_v1<6C-N_^);Zo2fb<{$z=#9S7)f
zhB)DZ;8_V=;f?3uAhT+26XJ~T3S^FVq@r6=;l<_6Al$~P)ZvAo|I!!d)5YFoz6}_kNyk^<_BZ`bsl|Q0f!=UHY7s29To`UXS@bvtE2-K4vw`6TdIFfmVHHI
zcnUy>?q~%+-yWueMg$9F<2!>E%-7@(ge;2NVJY2`^DG>L8~7Y|q`);lL=(X-=(!d~
z>T+6o-s%e9j
zr7R8N{&lW__JJNuajpT^6x0>)3*03PuBq(z@xJ+EAUL%<$ur2c&LHb&I^QD7AT00B
zJ6uc?jBEt`nR8lnDp#u<2T0vr&93fQ<`IYR?&KPtit~5u4<|Hep9Btrv)?9=u~O50
z_8sYj*?Db7__>PX9tx<11)C^)Wy@+Qx<$kqvq?+zD^Td}j~s!pd=JNRy2kyqA-PdX
zqra{Ag)HF0_sZ-=qa?ka))pI`LZQFhz>jQ2o6TH_kk4SxlN1j3hbQgBas066y`g4%~IB?`t%
zU;NZl`%v=gP`tg)A?LtRUrjS%*+lI!05TE*8oab#(<-c_L&%(c2d%k`?H)(0=|blD&>Ae()9w^4QVZK~W{k7K$Q#M#&vvBnT6$iELhorkVwP
z(Z7Dr1=)W5cH5AY@G+1IMxVulm6&{j^RO*1i6XrPde!}c<>h}C#<SsrNf2PW69EO1D_J1UhJ718+8N2IB?hz|O`v;=1@9u=KAo#Q^HmeSYrp68jjcMfrsj3u~3hp5;U2oo>EBPk=9ZoQ}(9TBaH_N>uj;FA2
zOp%$L58dGicTIOn;fW=@0Ecrr
zbGGE;>WE7Z7WB2NHAz)~A)rA3W2)KYW
z!)rUi>pq*O;CN8^QrIDRALhLo?_VR$OJLB9TSb!on^k~IkEqG!=@Y6000A+I{l;9k
zpp~45MXHcD6bO!W)^725LYVMHU(pc_ebg+rsS
z&0Qm^@J$6OknqS#taa}y3A`FUh8YL}Cye;U;o;=zw>IwzfN&*;G@6l!40fk$jEidF
zX-C;OoGO9$T9chZ9$xTGX6m_WJ4ecwPNJm9xSc0Eq1%JDe;z{e5jWmz4R9rMxtD&v
zt~LhRAPs+mDB8Jm(`Af|l8x4lf#?
z?4qJyGJTZvire-2@n4;j!^EnO_9v0E#DiP+jf;C86^IJLyBd3;wTR1Kjky2XbGrfF
zM0A$?o7|Dkkv2USn7a_`1Vf4=yVd2D=~bNLfTLaQBADJ
zcP8g-%L&xSr?4xKJBUn_E_Olx3}Q$9IyTMDd7)=GVL|;u;+Q52en1CxFHZCKyT)qa
zKZsNs{P3dwGAZ#LT6~!PgGJY(L>Xl7DNHvK_WT{)fLv9Mq`P=WOrd&4adl$lTPEFn
z87Z;34RlwuWL^Z8oJd;46B46iDe>L>&Tj&Bl_k|RLc$uiZ3p<~p6+5M*SQF7fux4-
zYf_0k@)+5HLz*seQQsU|B4yLX$sUKHo#Hszfg|J~qQdgjmGV5`mASiPpz&9wwfYdC
z+61uEXFy$A?IRmnuR&89W&D~X66oIawJ4K0RmAqP`x{wvW2_X{CTn;m=g~2tGJ~ux
z=ll-FEAmyQbx&P7)KlcUlM+|2K$CWLzDa&@#A&$kC`0OW>`Q7oSQeuv7@j5A*?rZ|
zb!EzfkwAY?P?IDyS&us?q)?K^N*!FHHYLbk?)DM;6A_x}yqYp3j?R~cAt8$txPVJo
zAL`<}l`#X{d5j7%NRfp`C?zhp-_~QpjNN2!U{w+c>mzoKD;Y!izKf_BK&rugzmZP*
z!sjZ!xNcVttML5_-n#`yk3|psPD6Xt&41~V8G`cD4SjWzKu{lqS~$f{16oc5=KyhV
zu)U4Ms`sKEYX%hZph-PUL*(|~20Mh6p;XvVb-;|7ap{7tY5jRAh=*C@>G
zz7qLwPV18TlJkVW3X0F+&~T55_&QsQpe8Uk9@An01&+}NI|}65qxc@UbWSGk^uQd;
z``wCN?IsFPIZN)vG5%XQJBjH+FUZ!;2#aD+kUc~K%`6(B3ALBq8QHgzZT-gK{Q%>T
z>IHYx=kg-rHpn3yd+mJc{D+HcK$2IfU^2_XN^5*>}
ziX54;{(3Js2cDAJZjf5FU!}mxdttE*dvyudi^hJNk&g9Wr5WR#dgXQI?X0J?n*U*}
zXTM@2qzwoFZfZ_%o~pl-*yV0nB20`*d)bF%uw-wa4?!41!aOx%b{ARKqV1cU)C|_f
z2*C&(ikW;E_4GYRl#}?bBMp!8A5wE-#}t5GO2!0f^F|YHvHq=f$kpL&Z_%u{Lw(rT
z;>BN8Y2#8aKB>Cz%#@>i%xlhrA*c&}7GX~QLe^$bU$N%?GjAqA`@2r0HI;$AX9*PQ
z-&UJ=Q{*`s_x;AD1R4Ee+MhCi$S{bZgsq9!vc47xL;c({wWHGa%op4s>4Jn*W!cn~
zI*2&ml`R@Dcf9krK|z6z5zSo6PhfvX4qeTHB^O3pK!-D~#I{+)y!vSPID0ZuCiRn}
z8TFn7Y0Pz^Z(Yk>LpixD+C>|^kCuf*G*WPnE5{`52eesw+M_T^%
z{WnGyPqh@YcOL&aT~9cuur{MZ>J7w6@*5*>ZIf$@;j;7S-TtauOFrqUXqmked#@p7
zb;2TyYjE{n9GK5w=zw(-Bn#7dWDk=%7V2nY;|G2{>b+@6rc9<2%k@_>n}|uXOS=UY
z-SN_mdW)tut0=iEyzmOd77V_CT9JynX44HrkgxOMzG!mddiLFk&~_8_Pnh)aFQY
zepsfaGIL`Y{tE|3;B9D~cEI8w(
z#!~V?_naQJOOQyqr>&!+hnrS4q5^KG6~~ZTB9PY&2cpjw?r$b+Ff@oG1LMV=vBY%r
zdlQ{41pRP-mq=1Zmb{_?OcshlNYM(@Azq>}X9$_a0a_N^%0hJxqrDg}ybn0+fub4o|4@nxP!cDcOyLmL0lUnxf
zPvVb#=7L@yzq9==T8AW>{*ZRNd;z8oNvG9brpFpq0v79;+}1uJurtrC(#NK24c50g
zk3cF=ygJtl^hYe+QSHd8ceq!K=_Kr4PYRQmk-nq7Yup_^ms-r|%^WX;HUF;)$KRGJ
zW_FgHPI+0(g6pq?9T!{~yefPUg2qO#)zQ0KCESMcjP{vBk{iQGf@v*YNVxUy!l>?a
zWrwCZ*{JjLKHfBH^9_~X({It)0Sc%640pg)z483+U=8=+fRC@SxjQ;@4gvX8I_)u*
z^Jb9Wfjz(DBXLVo3EQ-$C-Bcdg%q1}5y;L=H42^?#RMJI4AKMf5Go_a4=ZJ@2cq}t
z@TMZ*@hOWgNo@*-d)kNd`UpuTTfK58ox2A2g5T#ZfcM$wb4Sz5Nmu(g$$T76z->5#
z^rtBFtwKi8osKz=>IA0_@??c}^E<}@!px!(Br@giEZ{M0uXXM2^{5?c&RC)?fzT
zSNE$TlN%dEH(Kwv{A`(rRe-8sfY1LOhwOGc6EF0}{(mqt`TMP*Yzf}5F)*2WnBQRO
zvE+)9SlWf^qs{-O<{@;>c}M2}?V0y8cpv*`rT>Lg#OMb#vy`IqO5W{G<)6H@+gjm+
zn{sgw>jK$`gH$gM54M%IWB=Bx3|zo|G^%_{aDA}vXhW*`&)VzHPtM~V-Q_2%ZQH~V
z;547W{R@iV>+^N_dvRtLdhi*Wk+i3!D*2Xwyn?`d%u80f26Cj!^
zhZUC33#Xv_Yn{JwexU;mESCR)XTn$E)EBe^z#Y@*{ZoN~I~{YLVdh
zF=*JneAX5MebG93-(bBPW>R(zl#%9pHX;1f!Qx<4?rZTxB?Uzl2KwdRw4mzGXCLr3
zC#{5Gm{joYg6|0Ml>7<@jYyw>v#nF4Y2~^1GaaUln!FMk5`ot~%{bYAn#4tcU(dD0
zV=%^Do|@I2CHH`A7UYAbKO+8K!i>N?!Mt5Dz|zyS?q0;toZJTf+Z3gZ;un~O`m@b)
z*Pb6jOh17041y)tSXRO%(7A(2J#I^3q3Rn~aFOU@u8gGcv^S~!mhg8qk6VG~V^M1^
z49M{^i_WWm@Lr|M1#&e!Td)8xZ^gXJ6}OK*2b<^u9@ms0i62~xQTYaS{-%FT8Y?iE
z;Ss8S1_%zejrhKtH=_7?qnY#M7Sl1-pJ;L1)c*j3-^}!y06j+;ISWic_Z@B{y>C|6
z-*nkq%klXH2tM7HptA7jPN|U}Q2U$C0gVv{m|`iITeM$;H{X|i0vi2%W!s;#Z6N0P
zzniNI>(FXpf&5q{$Tbb&_LkUWBGO(zP
zS%cMG^ywnWydGZm#Ezf84Ugsoke_q4k0(pXez
zZ(0cA*sb2Ke7Nd5_&7RrTL#Nx^E?%TUSU|gdAc&Uby%q!HWLIm^f~~+3dYXpFw;y*D_X&6
zlr`G$g^NG7p4N3cjgM*?#bNvBU}m#f&R->%OAyhm^Q>eQ-+^zBd+g3G9aoBf(;R0}8z&-+_-wx>9|;(M)lgyT`QYo$=tgEoCC
z;&Bafj;meQFkDn$`vnWwOPMb4;LW3YfLZ;7S8b4a(;PmlcjFJkhLj=nXu=A=Mt?9@
zb`UZJIHb5gz)#qWw>lK31xS##Z`SA64_FoZoo$s&Y%1(nr7nNaIU#cHh#YNi1J$gd
z$u-YKZO_W&@uzmWaJ)Bh(T5X;>NDHUAlJnGIp3k{bz^2KUF~L?hqXt5qIDyv05t>-
zVc&P(%LuX@G7G%LYxG+B{i3A!2eiS6mgy8jMnmv>8=Iw2#r*K}I1AkrWh&>EY;g~7
z)C5Ncw70nOr_B$1fxj11Cl5C{+E!BfI1pyuTvayg%v1#I2u4xU3zV&xlCDj{t(&9xNg1)As6d%NXBB?fvlz9x)%n?0
zbwboDjn`3AYo0t|7Ay3YbMkZ^kmx9o;MwD9Mt+3L>5DDqw8OkfB#0kO66I8&`pF~i
z1hRJ~^;zASLh>vUbL
z#M5|aW+`)aB%k+~76(Mt`)(Jcmoho*Atw|22!AWGt1&f+OfJ=5MHB}tl%HHu1Z?7;&T@<$IS2Uo~jwJy+XgG1Gi3VqHT}b=#F96wAMn%^~H94jvD-5&k>@mz2X+2RgGb&k=k0cI`g#%J*1O
zf7Vx{Nd64}$UuFLFMoo6E?>9|z)C%HRu=uiUO?5`MBc}Yi$SNmVEK-v_Ig$wLIivc
zjnRTRwgU;u=|SZ|1KADIE<@R-YsGQrNod4h=SO|BcL(An3*ic4-s>5>bl=cw+mxL2
zW5>})RFgqtVx|qb$G}MCI=@vsQ7Zi<-+mC!gmc^mOgd
z5@EbA^f*Ig>Z`yn#l)N3_o>TUE{)}6pou|`1VLbQT>c&-#2=($#Ftpk^xg<81OH
z{SWs9|FDpWkz*q6?{+aX^g9EFK$i633x^rEP#BD;{k^~{%pc`cfT8ky3@4AO-qa#_)t_6%jc;uDd*2pXCT>e86+*L(qd)s|o
zbkd1j#SCid!-2ESdEh&x90WkoIQX5g8iF6hZ{J!_#uEgkpB;}Qd|@u`;qS?3U6$#Z
zbLl~9g$XTYe=oedj`HI#{(^W(b7}?RvP(1VMPzmuFp<%1VBOxP(2I$>DBTLVLzj`j
zMe+hj_o@n@5YHgS`od-NsVsU}c7`u}fp*=D928z%mdNLQM*unvQ7(q{va${TVgjaR
zwiHvOGKiikE<_U3i>W?;oSuM>M2XCF{rFkW+uXYt0fo(XZ|QwFsQ&^c_NRdGcaELO
z1z%(v*IS$wLwF?pJlsanF%_~KajuQMeS+)b
zrFgdjKghwH_nStai0<*oqII_DTBfNk`+>ihaeGwW=<@+vFJ5$3I1|Hu#mA1WP;Sjo
zKGkh5tf*IRK=7hmZ|kkguVn3Ns08%>V!n~qSt@9?_#*m_3sXj8ny?|OY5ma0v;mY2
zz2BV!zo2TDvEoIHjhmKV==D$4agd4hI7w2IW@QPfHma$qPC7MqI8~#lg%#A2He0Hf
zFNg^u{x>1y;YRC0wq@_d4LIlLx*Qyff4T1-RMig38@6U8$;>cFyJ$bLWKbaZK;Y~k
zV>Cq8Hd(sv_3M{I4JWZ>{uQi4RGmlhmh@Eg<^&_h990KALWrC4Sso}|I|Ja#7j9>l
z7!kh0cCUo_TgOcoDxc>TndyA>ZFXUB71F{7DkXD)HT4~ED};=Y;b!6n6%(_$<{z?(
z>xj5_yaQ~){9JIk4B@H+m$g#EEY&N0619Z84!RyaVPu>}cDH%~?UbGdza0ujy=Z_5|Vi
zrd!5n9yNwH?pIr&Hdo21SToJAoNbQK<^0a)CLE3-UG%;68I1nL2E^_S-Et`z8m}LF
zJr5nl=3C&NTTtboOmC06(5%{Y*7gTb!hL49fL=+4yE>(eb18W88_05mREv%Aflo_v
z_6z4sOEZX1OGa?41F50e`){g~3|xk38c6>m=M1*Pu{^?TQvzxVmsXR*E54LNs-c*Y
zR3WN^_^xBcZ06|N!dsCo-F{M}QOaWio-;C7%8;_ruFw@OO^;)8XI)!^%d>>uFMR$mRZo@D^W;nHSRIfP={GQb)LjzZ&N8159ZQ|=a4T@#ZR(yxzg>>%Y&G#Mq(Gz6J
z#F?aU7@`;@uzQG`lkXUa>|XC;Frju|%dG}aKewlvI{!S5ZA6eZf4fG2AX6-V>6BwD
za|ac}pK)kUdX#tMxlzq5JIPZ4kBlQL=Qp=hGbP*l0JvUa%9`x#5x;7B>BTTHFO&AW
zu}ju>6N3zx?o$h~RZthNW&xNg7^ai@u)S70q#zLMz8C~IchNZeU);TCG@NhLKAMCe
z(MgEty^|2VccMjz=%NKtMrRBr2~i@-=w%R{=)DfnJ5fg+z4to0^Z32*`k%Ab`FcK`
zkJj_d?YZmT_ukjOE`T8HBQ7l`ADPui#Q3_{{DsC6cIG>5J%Q^7`V}16MH;qw7*e%?
zF0EUe*hN#}7C(-PtBLMGe!3L|!=LjYeqGb5x7WWDi~yR`7Lxvbz3s0aU!UiyrI^7O
znpeK<$8fHOK28vAk+pPq$Vqzo;|IK2mBQ>pX802+!a{rC7V<%va01LbYh4hUQJ$fm
z%^jn+Y(pA=2HaBmvE&~gc%>>G?4Yy!SwVsea~0`(wzzsFjlXergMdQEE9{DCfv}i|
zI=0cDeX}G!y=JDaYyrIfnRIR*Z)BTuamSI0_cewFK#LHM$ysBpn)-_t2q-Oj
z_F{4}p$HqXOisr4Jdf6C&HcxzYSA0Xd4yZc#bS2I3Fsnqna>4wN~Cq`HGmkU1xRI{
zt_E9;g!cX$tVP}@L=T==nM1jx1kprhcqk9e4F!Ply+0bW0iy>TRG2OD1?zwdq_x=o
z{e`JmBpgzpu~hW9f;xA(@>|-sr0`ios_$1J^BdQr3BdNF@ahXd0NExMTAu?M?p-{Z
z>pgA<6*ANjc`pUpI7$4W(v8oScG{m1Lr^TPY{0y;wP9-YoX5O@|
z_bBWKgVulLvR>4VIQhHS*UWjSHa=%&|9+G~Me&RRllWEe+un7!>tMcwFr7FXlRP8KsJm-_qH_ER)JUAwb0DLEQs;O2VQbx1z99c;fxd8s}v{*MMB@FpOFXstz(
zT2eM@d6qQT`G9QtU-1RC5aPy>?py_X_t7F}fDN|`c>Po8TfrIoiiM^Yg&*5Nz9ao}
zft)|b8*9B2oE(!~*Udt46J8C)iT>rVnOVY$(&y1P4EWZ7g{1a6TmwoQlBZhRtGcpW
zbqSYm%VR6a2uK(7-?h_xt5t9gT^#HRgWMx}BwjjKMe(xi``5KODU^Ljs7;!jVAdp%
zYqt1WhekVv1YN{2f>SW!bGhLf!^7`@NXlsw$On)
zuvAD6-3qtCZ{unt)~@rFb+1a|btL)L)A(ZUC^JIkYPz3hi+JEphyK&JkG*wYDD({a
zs#PwDf2%veo$Am7R=9wHGuoODWmrd$y6&9(9mAUDatMZ`U4=oCA(0&%JDy)=UQ^gx
zDMHp#S#SSDYRPe0VEIqhaw4vH3IIu(9fae2K5p-WZroKsPuhN4-mhC~^{=e(
zo>jxgsmqYd2z}e^SXmmq75NKXdIO-8ionh9FQwRv?nH7oz+wC$0|$!)bL$$<(0s8H
zW!rw`u*#G|i2;XM_A^`lEBmm7M^-)XUwQ+}pPF)~1pYFni-_iNk;xioSz|J)IPbC9zhp6y|gH
z&QE$e)@L4M?Ig$CiJ>8X%d5M#oPN&=v!-;FpMKw1m6KGl^A_-^(4*x0X3QeBl2TqH
zKB;T+dJMZccUxSt1XitIrGE6_t>{Q{jcbuZ-H%Td;QYAaYJJegB7H!$zi<}!aGIW!
zG(=UdS%$LwHp@PB2{P3S2S;W72%>`gE<3JhWiw3GWfk9mv2LZ@b_8E3wTs-mXq~u3
zopbBV8g6>+>hb$V5HZj`>7`miEWCK;b&MNoMigzY(x&}Ja|m_%Y_O)K4rd#WLhYQ$
zBQ~shH2PMBHihYK+Cx}B;p?)6Y~rr^J(@Lu+ccqaD1(R$$Bg1rxr8ni7X3DS`^Q``
z02(YTPv#;e^vAXeTJ3Cj(e||u6l^d8N12whsSDN;nf%%EvuOtScp<)cnF=^>Ey(2N*#g@G4`^OVLwjjlAvEK!tE^E$LD{D8>dT9w-IUex1-
zE>9smZeFi2<{LI1<<0=dmzl>^OX{yY5c;y)t3hXKlnXwjc(ZMr^$Nd^=&vgu6dPc9
zsPjAUaXap$Vigy#j;PD)L$bNb_r{s5VN}Q@Yi7=rLtXi5p{!W;-Rd2`VynGVuVgxi
zgoW0*N@XoCbzoI;?X|LyL&c5+cR*esut*PSylS;4M~RS6F+@2ZJI^e<4-uR7o|KkR
z`t`gA1*YmstbRW&@QDHWTify<1AeVSnI*mS$O6Gi{`^@9zth7qjuU`nHt8Ov*7nw5
zR#{JqNMYwk_ks?KJ=gPUZxIbwn$N?TJ_W&FT#;reZLtaD9?$#CCw`lZ|1`ULw{*Mg
zyBaJon}~Oy$9e}O;2ysoDv)sCw}((ulX01-D#P_6)rpb>L^V`RQnWr61}pRv5l;L|
zyFJNW+~mfYG}<&obvsP&K9}+wPfLkm%g9XI
zLKH3*Y3QUXwe6rRF@5i=@O~*yXU%PI8q;@|)J1MuJNddsbVc$SA#g1AM5dGULoZSU
z10uuHi(VVI79MT7>6yk4ayldlzHH_h%V~P$@U?cQNKyYv)POps4q1fimNJVnDZJJ{
z5Ytw~87*u)%-PmIrMa8fvVAFwQ=$Uz&f@kC#RjO4)}(X$#Tuqin0Ca+tjovSX1bW7
z5R*-1);>E*2T3ccaQ%lbW{zc@xpOB;@^
zJeH)15)j(94xCSXD>D^^z1E!g1E+wNOa)7YMto-xgV^d~;17Rc`WVIO-!_8dO)sKS
z^!wviGLtw&khJnD&Ji`=gAxajCHUvu-KW#He)k142ThRhyG24MPBNTvV`LJpk6W=b
zllI_Ym~wGEEh)!D@t-lu$u+c9FP%E)3=>++6^r=839db7Y<2tVAeb$Q^u;@XCZsn6
z5@q2mTARwvNyfp%#xq8Si%C=HDsoFvM6wXo&ky--l)P!^9OJh7`#Xm(ckn81snJsV~6HPH8gB>EW`|ZP%8s-dG%Of;9F5O>D{0#pK@I4%SuC%N?
zF`GdmAv;}sfIG-b!R9d4V$F+KG4W&G6rHIR$|TBrmwAko_CtF}N*Wm