Merge remote-tracking branch 'refs/remotes/origin/master' into jdhello

windows/deploy/TOC.md

@@ -11,6 +11,9 @@
 #### [Deploy Windows](upgrade-analytics-deploy-windows.md)
 #### [Review site discovery](upgrade-analytics-review-site-discovery.md)
 ### [Troubleshoot Upgrade Analytics](troubleshoot-upgrade-analytics.md)
+## [Step by step guide: Configure a test lab to deploy Windows 10](windows-10-poc.md)
+### [Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit](windows-10-poc-mdt.md)
+### [Deploy Windows 10 in a test lab using System Center Configuration Manager](windows-10-poc-sc-config-mgr.md)
 ## [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-10-with-the-microsoft-deployment-toolkit.md)
 ### [Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md)
 #### [Key features in MDT 2013 Update 2](key-features-in-mdt-2013.md)
@@ -50,8 +53,17 @@
 ## [Windows 10 upgrade paths](windows-10-upgrade-paths.md)
 ## [Windows 10 edition upgrade](windows-10-edition-upgrades.md)
 ## [Provisioning packages for Windows 10](provisioning-packages.md)
-### [Provision PCs with common settings for initial deployment](provision-pcs-for-initial-deployment.md)
-### [Provision PCs with apps and certificates for initial deployments](provision-pcs-with-apps-and-certificates.md)
+### [How provisioning works in Windows 10](provisioning-how-it-works.md)
+### [Install Windows Imaging and Configuration Designer](provisioning-install-icd.md)
+### [Create a provisioning package](provisioning-create-package.md)
+### [Apply a provisioning package](provisioning-apply-package.md)
+### [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md)
+### [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
+### [Provision PCs with apps and certificates for initial deployments (advanced provisioning)](provision-pcs-with-apps-and-certificates.md)
+### [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
+### [NFC-based device provisioning](provisioning-nfc.md)
+### [Windows ICD command-line interface (reference)](provisioning-command-line.md)
+### [Create a provisioning package with multivariant settings](provisioning-multivariant.md)
 ## [Deploy Windows To Go in your organization](deploy-windows-to-go.md)
 ## [Upgrade a Windows Phone 8.1 to Windows 10 Mobile with Mobile Device Management](upgrade-windows-phone-8-1-to-10.md)
 ## [Sideload apps in Windows 10](sideload-apps-in-windows-10.md)

windows/deploy/assign-applications-using-roles-in-mdt-2013.md

@@ -122,11 +122,11 @@ Figure 14. ZTIGather.log displaying the application GUID belonging to the Adobe
 ## Related topics
 
 [Set up MDT for BitLocker](set-up-mdt-2013-for-bitlocker.md)
-[Configure MDT deployment share rules](configure-mdt-deployment-share-rules.md)
-[Configure MDT for UserExit scripts](configure-mdt-2013-for-userexit-scripts.md)
-[Simulate a Windows 10 deployment in a test environment](simulate-a-windows-10-deployment-in-a-test-environment.md)
-[Use the MDT database to stage Windows 10 deployment information](use-the-mdt-database-to-stage-windows-10-deployment-information.md)
-[Use web services in MDT](use-web-services-in-mdt-2013.md)
-[Use Orchestrator runbooks with MDT](use-orchestrator-runbooks-with-mdt-2013.md)
+<BR>[Configure MDT deployment share rules](configure-mdt-deployment-share-rules.md)
+<BR>[Configure MDT for UserExit scripts](configure-mdt-2013-for-userexit-scripts.md)
+<BR>[Simulate a Windows 10 deployment in a test environment](simulate-a-windows-10-deployment-in-a-test-environment.md)
+<BR>[Use the MDT database to stage Windows 10 deployment information](use-the-mdt-database-to-stage-windows-10-deployment-information.md)
+<BR>[Use web services in MDT](use-web-services-in-mdt-2013.md)
+<BR>[Use Orchestrator runbooks with MDT](use-orchestrator-runbooks-with-mdt-2013.md)
  
  

windows/deploy/change-history-for-deploy-windows-10.md

@@ -11,6 +11,26 @@ author: greg-lindsay
 # Change history for Deploy Windows 10
 This topic lists new and updated topics in the [Deploy Windows 10](index.md) documentation for [Windows 10 and Windows 10 Mobile](../index.md).
 
+## January 2017
+| New or changed topic | Description |
+|----------------------|-------------|
+| [Step by step guide: Configure a test lab to deploy Windows 10](windows-10-poc.md) | New | 
+| [Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit](windows-10-poc-mdt.md) | New | 
+| [Deploy Windows 10 in a test lab using System Center Configuration Manager](windows-10-poc-sc-config-mgr.md) | New | 
+| [Apply a provisioning package](provisioning-apply-package.md) | New (previously published in other topics) | 
+| [Create a provisioning package for Windows 10](provisioning-create-package.md) | New (previously published in Hardware Dev Center on MSDN) | 
+| [Create a provisioning package with multivariant settings](provisioning-multivariant.md) | New (previously published in Hardware Dev Center on MSDN) | 
+| [How provisioning works in Windows 10](provisioning-how-it-works.md) | New (previously published in Hardware Dev Center on MSDN) | 
+| [Install Windows Imaging and Configuration Designer](provisioning-install-icd.md) | New (previously published in Hardware Dev Center on MSDN) |
+| [NFC-based device provisioning](provisioning-nfc.md) | New (previously published in Hardware Dev Center on MSDN) | 
+| [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md) | New (previously published in Hardware Dev Center on MSDN) | 
+| [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md) | New (previously published in Hardware Dev Center on MSDN) |
+|  [Windows ICD command-line interface (reference)](provisioning-command-line.md) | New (previously published in Hardware Dev Center on MSDN) |
+| [Get started with Upgrade Analytics](upgrade-analytics-get-started.md) | Updated exit code table with suggested fixes, and added link to the Upgrade Analytics blog | 
+| [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md) | Instructions for applying the provisioning package moved to [Apply a provisioning package](provisioning-apply-package.md) |
+| [Provision PCs with apps and certificates for initial deployments (advanced provisioning)](provision-pcs-with-apps-and-certificates.md) | Instructions for applying the provisioning package moved to [Apply a provisioning package](provisioning-apply-package.md) |
+
+
 ## October 2016
 | New or changed topic | Description |
 |----------------------|-------------|

windows/deploy/create-a-windows-10-reference-image.md

@@ -167,7 +167,7 @@ If you need to add many applications, you can take advantage of the PowerShell s
 2.  Import the snap-in and create the PSDrive by running the following commands in an elevated PowerShell prompt:
 
     ``` syntax
-    Import-Topic "C:\Program Files\Microsoft Deployment Toolkit\bin\MicrosoftDeploymentToolkit.psd1"
+    Import-Module "C:\Program Files\Microsoft Deployment Toolkit\bin\MicrosoftDeploymentToolkit.psd1"
     New-PSDrive -Name "DS001" -PSProvider MDTProvider -Root "E:\MDTBuildLab"
     ```
 

windows/deploy/index.md

@@ -17,6 +17,7 @@ Learn about deploying Windows 10 for IT professionals.
 |------|------------|
 |[Windows 10 deployment scenarios](windows-10-deployment-scenarios.md) |To successfully deploy the Windows 10 operating system in your organization, it is important to understand the different ways that it can be deployed, especially now that there are new scenarios to consider. Choosing among these scenarios, and understanding the key capabilities and limitations of each, is a key task. |
 |[Manage Windows upgrades with Upgrade Analytics](manage-windows-upgrades-with-upgrade-analytics.md) |With Upgrade Analytics, enterprises now have the tools to plan and manage the upgrade process end to end, allowing them to adopt new Windows releases more quickly. With Windows telemetry enabled, Upgrade Analytics collects system, application, and driver data for analysis. We then identify compatibility issues that can block an upgrade and suggest fixes when they are known to Microsoft. The Upgrade Analytics workflow steps you through the discovery and rationalization process until you have a list of computers that are ready to be upgraded. | 
+|[Step by step guide: Configure a test lab to deploy Windows 10](windows-10-poc.md) |This guide contains instructions to configure a proof of concept (PoC) environment requiring a minimum amount of resources. The guide makes extensive use of Windows PowerShell and Hyper-V. Subsequent companion guides contain steps to deploy Windows 10 using the PoC environment. After completing this guide, see the following Windows 10 PoC deployment guides: [Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit](windows-10-poc-mdt.md), [Deploy Windows 10 in a test lab using System Center Configuration Manager](windows-10-poc-sc-config-mgr.md). |
 |[Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-10-with-the-microsoft-deployment-toolkit.md) |This guide will walk you through the process of deploying Windows 10 in an enterprise environment using the Microsoft Deployment Toolkit (MDT), and MDT 2013 Update 2 specifically. |
 |[Deploy Windows 10 with System Center 2012 R2 Configuration Manager](deploy-windows-10-with-system-center-2012-r2-configuration-manager.md) |If you have Microsoft System Center 2012 R2 Configuration Manager in your environment, you will most likely want to use it to deploy Windows 10. This topic will show you how to set up Configuration Manager for operating system deployment and how to integrate Configuration Manager with the Microsoft Deployment Toolkit (MDT) or, more specifically, MDT 2013 Update 2. |
 |[Upgrade to Windows 10 with the Microsoft Deployment Toolkit](upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md) |The simplest path to upgrade PCs that are currently running Windows 7, Windows 8, or Windows 8.1 to Windows 10 is through an in-place upgrade. You can use a Microsoft Deployment Toolkit (MDT) 2013 Update 2 task sequence to completely automate the process. |
@@ -24,8 +25,7 @@ Learn about deploying Windows 10 for IT professionals.
 |[Resolve Windows 10 upgrade errors](resolve-windows-10-upgrade-errors.md) |This topic provides a brief introduction to Windows 10 installation processes, and provides resolution procedures that IT administrators can use to resolve issues with Windows 10 upgrade. |
 |[Configure a PXE server to load Windows PE](configure-a-pxe-server-to-load-windows-pe.md) |This guide describes how to configure a PXE server to load Windows PE by booting a client computer from the network. |
 |[Windows 10 edition upgrade](windows-10-edition-upgrades.md) |With Windows 10, you can quickly upgrade from one edition of Windows 10 to another, provided the upgrade path is supported. |
-| [Provision PCs with common settings for initial deployment](provision-pcs-for-initial-deployment.md) | Create a provisioning package to apply commonly used settings to a PC running Windows 10. |
-|  [Provision PCs with apps and certificates for initial deployments](provision-pcs-with-apps-and-certificates.md) | Create a provisioning package to add apps and certificates to a PC running Windows 10. |
+| [Provisioning packages for Windows 10](provisioning-packages.md) | Learn how to use the Windows Imaging and Configuration Designer (ICD) and provisioning packages to easily configure multiple devices. |
 |[Windows 10 upgrade paths](windows-10-upgrade-paths.md) |You can upgrade directly to Windows 10 from a previous operating system. |
 |[Deploy Windows To Go in your organization](deploy-windows-to-go.md) |This topic helps you to deploy Windows To Go in your organization. Before you begin deployment, make sure that you have reviewed the topics [Windows To Go: feature overview](../plan/windows-to-go-overview.md) and [Prepare your organization for Windows To Go](../plan/prepare-your-organization-for-windows-to-go.md) to ensure that you have the correct hardware and are prepared to complete the deployment. You can then use the steps in this topic to start your Windows To Go deployment. |
 |[Upgrade a Windows Phone 8.1 to Windows 10 Mobile with Mobile Device Management](upgrade-windows-phone-8-1-to-10.md) |This topic describes how to upgrade eligible Windows Phone 8.1 devices to Windows 10 Mobile. |

windows/deploy/provision-pcs-for-initial-deployment.md

@@ -4,7 +4,7 @@ description: Create a provisioning package to apply common settings to a PC runn
 ms.assetid: 66D14E97-E116-4218-8924-E2A326C9367E
 keywords: ["runtime provisioning", "provisioning package"]
 ms.prod: W10
-ms.mktglfcycl: manage
+ms.mktglfcycl: deploy
 ms.sitesec: library
 author: jdeckerMS
 localizationpriority: high
@@ -92,40 +92,30 @@ Use the Windows Imaging and Configuration Designer (ICD) tool included in the Wi
 > [!IMPORTANT]
 > When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed.
 
-## Apply package
 
-1. Start with a computer on the first-run setup screen. If the PC has gone past this screen, reset the PC to start over. To reset the PC, go to **Settings** > **Update & security** > **Recovery** > **Reset this PC**.
-
-    ![The first screen to set up a new PC](images/oobe.jpg)
-
-2. Insert the USB drive. Windows Setup will recognize the drive and ask if you want to set up the device. Select **Set up**.
-
-    ![Set up device?](images/setupmsg.jpg)
-
-3. The next screen asks you to select a provisioning source. Select **Removable Media** and tap **Next**.
-
-    ![Provision this device](images/prov.jpg)
-    
-4. Select the provisioning package (\*.ppkg) that you want to apply, and tap **Next**.
-
-    ![Choose a package](images/choose-package.png)
-
-5. Select **Yes, add it**.
-
-    ![Do you trust this package?](images/trust-package.png)
-    
+ **Next step**: [How to apply a provisioning package](provisioning-apply-package.md)   
 
 
 ## Learn more
--   [Build and apply a provisioning package]( https://go.microsoft.com/fwlink/p/?LinkId=629651)
 
 -   Watch the video: [Provisioning Windows 10 Devices with New Tools](https://go.microsoft.com/fwlink/p/?LinkId=615921)
 
 -   Watch the video: [Windows 10 for Mobile Devices: Provisioning Is Not Imaging](https://go.microsoft.com/fwlink/p/?LinkId=615922)
 
  
+## Related topics
 
- 
+- [Provisioning packages for Windows 10](provisioning-packages.md)
+- [How provisioning works in Windows 10](provisioning-how-it-works.md)
+- [Install Windows Imaging and Configuration Designer](provisioning-install-icd.md)
+- [Create a provisioning package](provisioning-create-package.md)
+- [Apply a provisioning package](provisioning-apply-package.md)
+- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md)
+- [Provision PCs with apps and certificates for initial deployments (advanced provisioning)](provision-pcs-with-apps-and-certificates.md)
+- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
+- [NFC-based device provisioning](provisioning-nfc.md)
+- [Windows ICD command-line interface (reference)](provisioning-command-line.md)
+- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)
 
 
 

windows/deploy/provision-pcs-with-apps-and-certificates.md

@@ -4,7 +4,7 @@ description: Create a provisioning package to apply settings to a PC running Win
 ms.assetid: 66D14E97-E116-4218-8924-E2A326C9367E
 keywords: ["runtime provisioning", "provisioning package"]
 ms.prod: W10
-ms.mktglfcycl: manage
+ms.mktglfcycl: deploy
 ms.sitesec: library
 author: jdeckerMS
 localizationpriority: high
@@ -57,7 +57,7 @@ Use the Windows Imaging and Configuration Designer (ICD) tool included in the Wi
 3. Go to **Runtime settings** > **ProvisioningCommands** > **DeviceContext** > **CommandLine** and specify the command line that needs to be executed to install the app. This is a single command line (such as a script, executable, or msi) that triggers a silent install of your CommandFiles. Note that the install must execute silently (without displaying any UI). For MSI installers use, the `msiexec /quiet` option. 
 
 > [!NOTE]
-> If you are installing more than one app, then use CommandLine to invoke the script or batch file that orchestrates installation of the files. For more information, see [Install a Win32 app using a provisioning package](https://msdn.microsoft.com/library/windows/hardware/mt703295%28v=vs.85%29.aspx). 
+> If you are installing more than one app, then use `CommandLine` to invoke the script or batch file that orchestrates installation of the files. For more information, see [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md). 
 
 
 ### Add a universal app to your package
@@ -170,66 +170,27 @@ If your build is successful, the name of the provisioning package, output direct
 
 
 
-## Apply package
-
-### During initial setup, from a USB drive
-
-1. Start with a computer on the first-run setup screen. If the PC has gone past this screen, reset the PC to start over. To reset the PC, go to **Settings** > **Update & security** > **Recovery** > **Reset this PC**.
-
-    ![The first screen to set up a new PC](images/oobe.jpg)
-
-2. Insert the USB drive. Windows Setup will recognize the drive and ask if you want to set up the device. Select **Set up**.
-
-    ![Set up device?](images/setupmsg.jpg)
-
-3. The next screen asks you to select a provisioning source. Select **Removable Media** and tap **Next**.
-
-    ![Provision this device](images/prov.jpg)
-    
-4. Select the provisioning package (\*.ppkg) that you want to apply, and tap **Next**.
-
-    ![Choose a package](images/choose-package.png)
-
-5. Select **Yes, add it**.
-
-    ![Do you trust this package?](images/trust-package.png)
-    
-6. Read and accept the Microsoft Software License Terms.  
-
-    ![Sign in](images/license-terms.png)
-    
-7. Select **Use Express settings**.
-
-    ![Get going fast](images/express-settings.png)
-
-8. If the PC doesn't use a volume license, you'll see the **Who owns this PC?** screen. Select **My work or school owns it** and tap **Next**.
-
-    ![Who owns this PC?](images/who-owns-pc.png)
-
-9. On the **Choose how you'll connect** screen, select **Join Azure AD** or **Join a domain** and tap **Next**.
-
-    ![Connect to Azure AD](images/connect-aad.png)
-
-10. Sign in with  your domain, Azure AD,  or Office 365 account and password. When you see the progress ring, you can remove the USB drive.
-
-    ![Sign in](images/sign-in-prov.png)
-    
-
-### After setup, from a USB drive, network folder, or SharePoint site
-
-On a desktop computer, navigate to **Settings** > **Accounts** > **Work access** > **Add or remove a management package** > **Add a package**, and select the package to install. 
-
-![add a package option](images/package.png)
+**Next step**: [How to apply a provisioning package](provisioning-apply-package.md)
 
 ## Learn more
--   [Build and apply a provisioning package]( https://go.microsoft.com/fwlink/p/?LinkId=629651)
 
 -   Watch the video: [Provisioning Windows 10 Devices with New Tools](https://go.microsoft.com/fwlink/p/?LinkId=615921)
 
 -   Watch the video: [Windows 10 for Mobile Devices: Provisioning Is Not Imaging](https://go.microsoft.com/fwlink/p/?LinkId=615922)
  
 
-
-
+## Related topics
+
+- [Provisioning packages for Windows 10](provisioning-packages.md)
+- [How provisioning works in Windows 10](provisioning-how-it-works.md)
+- [Install Windows Imaging and Configuration Designer](provisioning-install-icd.md)
+- [Create a provisioning package](provisioning-create-package.md)
+- [Apply a provisioning package](provisioning-apply-package.md)
+- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md)
+- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
+- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
+- [NFC-based device provisioning](provisioning-nfc.md)
+- [Windows ICD command-line interface (reference)](provisioning-command-line.md)
+- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)
 
 

windows/deploy/provisioning-apply-package.md

@@ -0,0 +1,119 @@
+---
+title: Apply a provisioning package (Windows 10)
+description: Provisioning packages can be applied to a device during the first-run experience (OOBE) and after ("runtime").
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+author: jdeckerMS
+localizationpriority: high
+---
+
+# Apply a provisioning package
+
+
+**Applies to**
+
+-   Windows 10
+-   Windows 10 Mobile
+
+Provisioning packages can be applied to a device during the first-run experience (out-of-box experience or "OOBE") and after ("runtime").
+
+## Desktop editions
+
+### During initial setup, from a USB drive
+
+1. Start with a computer on the first-run setup screen. If the PC has gone past this screen, reset the PC to start over. To reset the PC, go to **Settings** > **Update & security** > **Recovery** > **Reset this PC**.
+
+    ![The first screen to set up a new PC](images/oobe.jpg)
+
+2. Insert the USB drive. Windows Setup will recognize the drive and ask if you want to set up the device. Select **Set up**.
+
+    ![Set up device?](images/setupmsg.jpg)
+
+3. The next screen asks you to select a provisioning source. Select **Removable Media** and tap **Next**.
+
+    ![Provision this device](images/prov.jpg)
+    
+4. Select the provisioning package (\*.ppkg) that you want to apply, and tap **Next**.
+
+    ![Choose a package](images/choose-package.png)
+
+5. Select **Yes, add it**.
+
+    ![Do you trust this package?](images/trust-package.png)
+    
+6. Read and accept the Microsoft Software License Terms.  
+
+    ![Sign in](images/license-terms.png)
+    
+7. Select **Use Express settings**.
+
+    ![Get going fast](images/express-settings.png)
+
+8. If the PC doesn't use a volume license, you'll see the **Who owns this PC?** screen. Select **My work or school owns it** and tap **Next**.
+
+    ![Who owns this PC?](images/who-owns-pc.png)
+
+9. On the **Choose how you'll connect** screen, select **Join Azure AD** or **Join a domain** and tap **Next**.
+
+    ![Connect to Azure AD](images/connect-aad.png)
+
+10. Sign in with  your domain, Azure AD,  or Office 365 account and password. When you see the progress ring, you can remove the USB drive.
+
+    ![Sign in](images/sign-in-prov.png)
+    
+### After setup, from a USB drive, network folder, or SharePoint site
+
+On a desktop computer, navigate to **Settings** > **Accounts** > **Access work or school** > **Add or remove a provisioning package** > **Add a package**, and select the package to install. 
+
+![add a package option](images/package.png)
+    
+## Mobile editions
+
+### Using removable media
+
+1. Insert an SD card containing the provisioning package into the device.
+2. Navigate to **Settings** > **Accounts** > **Access work or school** > **Add or remove a provisioning package** > **Add a package**, and select the package to install. 
+
+    ![add a package option](images/packages-mobile.png)
+
+3. Click **Add**.
+
+4. On the device, the **Is this package from a source you trust?** message will appear. Tap **Yes, add it**.
+
+    ![Is this package from a source you trust](images/package-trust.png)
+    
+### Copying the provisioning package to the device
+
+1. Connect the device to your PC through USB.
+
+2. On the PC, select the provisioning package that you want to use to provision the device and then drag and drop the file to your device.
+
+3. On the device, the **Is this package from a source you trust?** message will appear. Tap **Yes, add it**.
+
+    ![Is this package from a source you trust](images/package-trust.png)
+
+
+#
+
+
+## Learn more
+
+-   Watch the video: [Provisioning Windows 10 Devices with New Tools](https://go.microsoft.com/fwlink/p/?LinkId=615921)
+
+-   Watch the video: [Windows 10 for Mobile Devices: Provisioning Is Not Imaging](https://go.microsoft.com/fwlink/p/?LinkId=615922)
+
+
+## Related topics
+
+- [Provisioning packages for Windows 10](provisioning-packages.md)
+- [How provisioning works in Windows 10](provisioning-how-it-works.md)
+- [Install Windows Imaging and Configuration Designer](provisioning-install-icd.md)
+- [Create a provisioning package](provisioning-create-package.md)
+- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md)
+- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
+- [Provision PCs with apps and certificates for initial deployments (advanced provisioning)](provision-pcs-with-apps-and-certificates.md)
+- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
+- [NFC-based device provisioning](provisioning-nfc.md)
+- [Windows ICD command-line interface (reference)](provisioning-command-line.md)
+- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)

windows/deploy/provisioning-command-line.md

@@ -0,0 +1,68 @@
+---
+title: Windows ICD command-line interface (Windows 10)
+description: 
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+author: jdeckerMS
+localizationpriority: high
+---
+
+# Windows ICD command-line interface (reference)
+
+
+**Applies to**
+
+- Windows 10
+- Windows 10 Mobile
+
+You can use the Windows Imaging and Configuration Designer (ICD) command-line interface (CLI) to automate the building of provisioning packages and Windows 10 for desktop editions (Home, Pro, Enterprise, and Education) and Windows 10 Mobile or Windows 10 IoT Core (IoT Core) images. 
+
+- IT pros can use the Windows ICD CLI to require less re-tooling of existing processes. You must run the Windows ICD CLI from a command window with administrator privileges.
+
+- You must use the Windows ICD CLI and edit the customizations.xml sources to create an image and/or provisioning package with multivariant support. You need the customizations.xml file as one of the inputs to the Windows ICD CLI to build a provisioning package. For more information, see [Create a provisioning package with multivariant settings](provisioning-multivariant.md). 
+
+
+
+## Syntax
+
+``` 
+icd.exe /Build-ProvisioningPackage /CustomizationXML:<path_to_xml> /PackagePath:<path_to_ppkg> 
+[/StoreFile:<path_to_storefile>]  [/MSPackageRoot:<path_to_mspackage_directory>]  [/OEMInputXML:<path_to_xml>]
+[/ProductName:<product_name>]  [/Variables:<name>:<value>] [[+|-]Encrypted] [[+|-]Overwrite] [/?]
+```
+
+## Switches and arguments
+
+| Switch | Required? | Arguments |
+| --- | --- | --- |
+| /CustomizationXML | No | Specifies the path to a Windows provisioning XML file that contains the customization assets and settings. For more information, see Windows provisioning answer file. |
+| /PackagePath | Yes | Specifies the path and the package name where the built provisioning package will be saved. |
+| /StoreFile | No</br></br></br>See Important note. | For partners using a settings store other than the default store(s) used by Windows ICD, use this parameter to specify the path to one or more comma-separated Windows settings store file. By default, if you don't specify a settings store file, the settings store that's common to all Windows editions will be loaded by Windows ICD.</br></br></br>**Important**  If you use this parameter, you must not use /MSPackageRoot or /OEMInputXML. |
+| /Variables | No | Specifies a semicolon separated <name> and <value> macro pair. The format for the argument must be <name>=<value>. |
+| Encrypted | No | Denotes whether the provisioning package should be built with encryption. Windows ICD auto-generates the decryption password and includes this information in the output.</br></br></br>Precede with + for encryption or - for no encryption. The default is no encryption. |
+| Overwrite | No | Denotes whether to overwrite an existing provisioning package.</br></br></br>Precede with + to overwrite an existing package or - if you don't want to overwrite an existing package. The default is false (don't overwrite). |
+| /? | No | Lists the switches and their descriptions for the command-line tool or for certain commands. |
+ 
+
+
+
+## Related topics
+
+- [Provisioning packages for Windows 10](provisioning-packages.md)
+- [How provisioning works in Windows 10](provisioning-how-it-works.md)
+- [Install Windows Imaging and Configuration Designer](provisioning-install-icd.md)
+- [Create a provisioning package](provisioning-create-package.md)
+- [Apply a provisioning package](provisioning-apply-package.md)
+- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md)
+- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
+- [Provision PCs with apps and certificates for initial deployments (advanced provisioning)](provision-pcs-with-apps-and-certificates.md)
+- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
+- [NFC-based device provisioning](provisioning-nfc.md)
+- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)
+ 
+
+
+
+
+

windows/deploy/provisioning-create-package.md

@@ -0,0 +1,148 @@
+---
+title: Create a provisioning package (Windows 10)
+description: With Windows 10, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image.
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+author: jdeckerMS
+localizationpriority: high
+---
+
+# Create a provisioning package for Windows 10
+
+
+**Applies to**
+
+-   Windows 10
+-   Windows 10 Mobile
+
+You use Windows Imaging and Configuration Designer (ICD) to create a provisioning package (.ppkg) that contains customization settings. You can apply the provisioning package to a device running Windows 10. 
+
+>[Learn how to install Windows ICD.](provisioning-install-icd.md)
+
+## Start a new project
+
+1. Open Windows ICD:
+    - From either the Start screen or Start menu search, type 'Imaging and Configuration Designer' and click on the Windows ICD shortcut, 
+    
+    or
+    
+    - Navigate to `C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86` (on an x64 computer) or `C:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\ICD.exe` (on an x86 computer), and then double-click **ICD.exe**.
+
+2. Select your desired option on the **Start** page, which offers three options for creating a provisioning package, as shown in the following image:
+
+    ![Simple provisioning or provision school devices or advanced provisioning](images/icd-create-options.png)
+    
+    - The **Simple provisioning** and **Provision school devices** options provide wizard-style walkthroughs for creating a provisioning package based on a set of common settings. 
+    - The **Advanced provisioning** option opens a new project with all **Runtime settings** available. 
+    >[!TIP]
+    >You can start a project in the simple editor and then switch the project to the advanced editor.
+    >
+    >![Switch to advanced editor](images/icd-switch.png)
+        
+3. Enter a name for your project, and then click **Next**.
+
+4. Select the settings you want to configure, based on the type of device, and then click **Next**. The following table describes the options.
+
+    | Windows edition | Settings available for customization | Provisioning package can apply to |
+    | --- | --- | --- |
+    | All Windows editions | Common settings | All Windows 10 devices |
+    | All Windows desktop editions | Common settings and settings specific to desktop devices  | All Windows 10 desktop editions (Home, Pro, Enterprise, Pro Education, Enterprise Education)   |
+    | All Windows mobile editions | Common settings and settings specific to mobile devices | All Windows 10 Mobile devices |
+    | Windows 10 IoT Core | Common settings and settings specific to Windows 10 IoT Core | All Windows 10 IoT Core devices |
+    | Windows 10 Holographic | Common settings and settings specific to Windows 10 Holographic  | [Microsoft HoloLens](https://technet.microsoft.com/itpro/hololens/hololens-provisioning)   |
+    | Common to Windows 10 Team edition | Common settings and settings specific to Windows 10 Team  | [Microsoft Surface Hub](https://technet.microsoft.com/itpro/surface-hub/provisioning-packages-for-certificates-surface-hub)  |
+ 
+5. On the **Import a provisioning package (optional)** page, you can click **Finish** to create your project, or browse to and select an existing provisioning packge to import to your project, and then click **Finish**.
+
+>[!TIP]
+>**Import a provisioning package** can make it easier to create different provisioning packages that all have certain settings in common. For example, you could create a provisioning package that contains the settings for your organization's network, and then import it into other packages you create so you don't have to reconfigure those common settings repeatedly.
+
+After you click **Finish**, Windows ICD will open the appropriate walkthrough page if you selected **Simple provisioning** or **Provision school devices**, or the **Available customizations** pane if you selected **Advanced provisioning**. The remainder of this topic will explain the **Advanced provisioning scenario**. 
+
+- For instructions on **Simple provisioning**, see [Provision PCs with common settings](provision-pcs-for-initial-deployment.md). 
+- For instructions on **Provision school devices**, see [Set up student PCs to join domain](https://technet.microsoft.com/edu/windows/set-up-students-pcs-to-join-domain).
+
+
+## Configure settings
+
+For an advanced provisioning project, Windows ICD opens the **Available customizations** pane. The example in the following image is based on **All Windows desktop editions** settings.
+
+![What the ICD interface looks like](images/icd-runtime.png)
+
+The settings in Windows ICD are based on Windows 10 configuration service providers (CSPs). To learn more about CSPs, see [Introduction to configuration service providers (CSPs) for IT pros](https://technet.microsoft.com/itpro/windows/manage/how-it-pros-can-use-configuration-service-providers).
+
+The process for configuring settings is similar for all settings. The following table shows an example.
+
+<table>
+<tr><td>![step one](images/one.png)</br>Expand a category.</td><td>![Expand Certificates category](images/icd-step1.png)</td></tr>
+<tr><td>![step two](images/two.png)</br>Select a setting.</td><td>![Select ClientCertificates](images/icd-step2.png)</td></tr>
+<tr><td>![step three](images/three.png)</br>Enter a value for the setting. Click **Add** if the button is displayed.</td><td>![Enter a name for the certificate](images/icd-step3.png)</td></tr>
+<tr><td>![step four](images/four.png)</br>Some settings, such as this example, require additional information. In **Available customizations**, select the value you just created, and additional settings are displayed.</td><td>![Additional settings for client certificate](images/icd-step4.png)</td></tr> 
+<tr><td>![step five](images/five.png)</br>When the setting is configured, it is displayed in the **Selected customizations** pane.</td><td>![Selected customizations pane](images/icd-step5.png)</td></tr>
+</table>
+
+For details on each specific setting, see [Windows Provisioning settings reference](https://msdn.microsoft.com/library/windows/hardware/dn965990.aspx). The reference topic for a setting is also displayed in Windows ICD when you select the setting, as shown in the following image.
+
+![Windows ICD opens the reference topic when you select a setting](images/icd-setting-help.png) 
+
+
+ ## Build package
+
+1. After you're done configuring your customizations, click **Export** and select **Provisioning Package**.
+
+    ![Export on top bar](images/icd-export-menu.png)
+    
+2. In the **Describe the provisioning package** window, enter the following information, and then click **Next**:
+    - **Name** - This field is pre-populated with the project name. You can change this value by entering a different name in the **Name** field.
+    - **Version (in Major.Minor format** - - Optional. You can change the default package version by specifying a new value in the **Version** field. 
+    - **Owner** - Select **IT Admin**. For more information, see [Precedence for provisioning packages](provisioning-how-it-works.md#precedence-for-provisioning-packages).
+    - **Rank (between 0-99)** - Optional. You can select a value between 0 and 99, inclusive. The default package rank is 0.
+    
+3. In the **Select security details for the provisioning package** window, you can select to encrypt and/or sign a provisioning package with a selected certificate. Both selections are optional. Click **Next** after you make your selections.
+
+    - **Encrypt package** -  If you select this option, an auto-generated password will be shown on the screen.
+    - **Sign package** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Select** and choosing the certificate you want to use to sign the package.
+
+    >[!NOTE]
+    >You should only configure provisioning package security when the package is used for device provisioning and the package has contents with sensitive security data such as certificates or credentials that should be prevented from being compromised. When applying an encrypted and/or signed provisioning package, either during OOBE or through the setting UI, the package can be decrypted, and if signed, be trusted without explicit user consent. An IT administrator can set policy on a user device to restrict the removal of required packages from the device, or the provisioning of potentially harmful packages on the device. 
+    >
+    >If a provisioning package is signed by a trusted provisioner, it can be installed on a device without a prompt for user consent. In order to enable trusted provider certificates, you must set the **TrustedProvisioners** setting prior to installing the trusted provisioning package. This is the only way to install a package without user consent. To provide additional security, you can also set **RequireProvisioningPackageSignature**, which prevents users from installing provisioning packages that are not signed by a trusted provisioner.
+
+4. In the **Select where to save the provisioning package** window, specify the output location where you want the provisioning package to go once it's built, and then click **Next**. By default, Windows ICD uses the project folder as the output location.
+
+5. In the **Build the provisioning package** window, click **Build**. The provisioning package doesn't take long to build. The project information is displayed in the build page and the progress bar indicates the build status. 
+
+    If you need to cancel the build, click Cancel. This cancels the current build process, closes the wizard, and takes you back to the Customizations Page.
+
+6. If your build fails, an error message will show up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again.
+
+    If your build is successful, the name of the provisioning package, output directory, and project directory will be shown. 
+
+    If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, click **Back** to change the output package name and path, and then click **Next** to start another build.
+
+7. When you are done, click **Finish** to close the wizard and go back to the Customizations page.
+
+**Next step**: [How to apply a provisioning package](provisioning-apply-package.md)
+
+## Learn more
+
+-   Watch the video: [Provisioning Windows 10 Devices with New Tools](https://go.microsoft.com/fwlink/p/?LinkId=615921)
+
+-   Watch the video: [Windows 10 for Mobile Devices: Provisioning Is Not Imaging](https://go.microsoft.com/fwlink/p/?LinkId=615922)
+
+
+
+## Related topics
+
+- [Provisioning packages for Windows 10](provisioning-packages.md)
+- [How provisioning works in Windows 10](provisioning-how-it-works.md)
+- [Install Windows Imaging and Configuration Designer](provisioning-install-icd.md)
+- [Apply a provisioning package](provisioning-apply-package.md)
+- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md)
+- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
+- [Provision PCs with apps and certificates for initial deployments (advanced provisioning)](provision-pcs-with-apps-and-certificates.md)
+- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
+- [NFC-based device provisioning](provisioning-nfc.md)
+- [Windows ICD command-line interface (reference)](provisioning-command-line.md)
+- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)

windows/deploy/provisioning-how-it-works.md

@@ -0,0 +1,184 @@
+---
+title: How provisioning works in Windows 10 (Windows 10)
+description: A provisioning package (.ppkg) is a container for a collection of configuration settings. 
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+author: jdeckerMS
+localizationpriority: high
+---
+
+# How provisioning works in Windows 10
+
+
+**Applies to**
+
+-   Windows 10
+-   Windows 10 Mobile
+
+Provisioning packages in Windows 10 provide IT administrators with a simplified way to apply configuration settings to Windows 10 devices. Windows Imaging and Configuration Designer (Windows ICD) is a tool that makes it easy to create a provisioning package. Windows ICD is contained in the [Windows Assessment and Deployment Kit (ADK)](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit). 
+
+## Provisioning packages
+
+A provisioning package contains specific configurations/settings and assets that can be provided through a removable media or simply downloaded to the device.
+
+To enable adding multiple sets of settings or configurations, the configuration data used by the provisioning engine is built out of multiple configuration sources that consist of separate provisioning packages. Each provisioning package contains the provisioning data from a different source.
+
+A provisioning package (.ppkg) is a container for a collection of configuration settings. The package has the following format: 
+
+- Package metadata – The metadata contains basic information about the package such as package name, description, version, ranking, and so on. 
+
+- XML descriptors – Each descriptor defines a customization asset or configuration setting included in the package. 
+
+- Asset payloads – The payloads of a customization asset or a configuration setting associated with an app or data asset. 
+
+You can  use provisioning packages for runtime device provisioning by accessing the package on a removable media attached to the device, through near field communication (NFC), or by downloading from a remote source location. 
+
+## Precedence for provisioning packages
+
+When multiple provisioning packages are available for device provisioning, the combination of package owner type and package rank level defined in the package manifest is used to resolve setting conflicts. The pre-defined package owner types are listed below in the order of lowest to highest owner type precedence:
+
+1. Microsoft 
+
+2. Silicon Vender 
+
+3. OEM 
+
+4. System Integrator 
+
+5. Mobile Operator 
+
+6. IT Admin 
+
+The valid value range of package rank level is 0 to 99. 
+
+When setting conflicts are encountered, the final values provisioned on the device are determined by the owner type precedence and the rank level of the packages containing the settings. For example, the value of a setting in a package with owner **System Integrator** and rank level **3** takes precedence over the same setting in a package with owner **OEM** and rank level **4**. This is because the System Integrator owner type has the higher precedence over the OEM owner type. For packages with the same owner type, the package rank level determines the package from which the setting values get provisioned on the device. 
+
+## Windows provisioning XML
+
+Windows provisioning XML is the framework that allows Microsoft and OEM components to declare end-user configurable settings and the on-device infrastructure for applying the settings with minimal work by the component owner. 
+
+Settings for each component can be declared within that component's package manifest file. These declarations are turned into settings schema that are used by Windows ICD to expose the potential settings to users to create customizations in the image or in provisioning packages. Windows ICD translates the user configuration, which is declared through Windows provisioning answer file(s), into the on-device provisioning format.
+
+When the provisioning engine selects a configuration, the Windows provisioning XML is contained within the selected provisioning data and is passed through the configuration manager and then to the Windows provisioning CSP. The Windows provisioning CSP then takes and applies the provisioning to the proper location for the actual component to use. 
+
+## Provisioning engine
+
+The provisioning engine is the core component for managing provisioning and configuration at runtime in a device running Windows 10. 
+
+The provisioning engine provides the following functionality:
+
+- Provisioning configuration at any time when the device is running including first boot and setup or OOBE. It is also extensible to other points during the run-time of the device.
+- Reading and combining settings from multiple sources of configuration that may be added to an image by Microsoft, the OEM, or system integrator, or added by IT/education administrators or users to the device at run-time. Configuration sources may be built into the image or from provisioning packages added to the device.
+- Responding to triggers or events and initiating a provisioning stage.
+- Authenticating the provisioning packages.
+- Selecting a set of configuration based on the stage and a set of keys—such as the SIM, MCC/MNC, IMSI range, and so on—that map to a specific configuration then passing this configuration to the configuration management infrastructure to be applied.
+- Working with OOBE and the control panel UI to allow user selection of configuration when a specific match cannot be determined.
+
+## Configuration manager
+
+The configuration manager provides the unified way of managing Windows 10 devices. Configuration is mainly done through the Open Mobile Alliance (OMA) Device Management (DM) and Client Provisioning (CP) protocols. The configuration manager handles and parses these protocol requests from different channels and passes them down to Configuration Service Providers (CSPs) to perform the specific management requests and settings. 
+
+The provisioning engine relies on configuration manager for all of the actual processing and application of a chosen configuration. The provisioning engine determines the stage of provisioning and, based on a set of keys, determines the set of configuration to send to the configuration manager. The configuration manager in turn parses and calls into the CSPs for the setting to be applied. 
+
+Underneath the configuration manager are the CSPs. Each section of configuration translates to a particular CSP to handle interpreting into an action on the device. Each CSP translates the instructions in the configuration and calls into the appropriate APIs and components to perform the requested provisioning actions. 
+
+## Policy and resource manager
+
+The policy, resource, and context manager components manage the enrollment and unenrollment of devices into enterprise environments. The enrollment process into an enterprise is essentially the provisioning of configuration and device management policies that the enterprise wants to enforce on the device. This is usually done through the explicit signing up of the device to an enterprise's device management server over a network connection. This provides the user with the ability to access the enterprise's resources through the device and the enterprise with a means to manage and control access and manage and control the device itself. 
+
+The key differences between enterprise enrollment and the configuration performed by the provisioning engine are: 
+- Enrollment enforces a limited and controlled set of policies on the device that the user may not have full control over. The provisioning engine exposes a larger set of settings that configure more aspects of the device and are generally user adjustable.
+- The policy manager manages policy settings from multiple entities and performs a selection of the setting based on priority of the entities. The provisioning engine applies the settings and does not offer a means of prioritizing settings from different sources. The more specific provisioning is the last one applied and the one that is used.
+- Individual policy settings applied from different enrollment entities are stored so they can be removed later during unenrollment. This enables the user to remove enterprise policy and return the device to a state without the enterprise restrictions and any sensitive data. The provisioning engine does not maintain individual provisioning settings or a means to roll back all applied settings.
+
+In Windows 10, the application of policy and enrollment through provisioning is required to support cases where an enterprise or educational institution does not have a DM server for full device management. The provisioning engine supports provisioning enrollment and policy through its configuration and integrates with the existing policy and resource manager components directly or through the configuration manager. 
+
+## Triggers and stages
+
+Triggers are events during the lifetime of the system that start a provisioning stage. Some examples of triggers are: boot, OOBE, SIM change, user added, administrator added, user login, device update, and various manual triggers (such as deployment over USB or launched from an email attachment or USB flash drive).
+
+When a trigger occurs, provisioning is initiated for a particular provisioning stage. The stages are grouped into sets based on the scope of the settings:
+- **Static**: First stage run for provisioning to apply configuration settings to the system to set up OOBE or apply device-wide settings that cannot be done when the image is being created.
+- **System**: Run during OOBE and configure system-wide settings.
+- **UICC**: UICC stages run for each new UICC in a device to handle configuration and branding based on the identity of the UICC or SIM card. This enables the runtime configuration scenarios where an OEM can maintain one image that can be configured for multiple operators.
+- **Update**: Runs after an update to apply potential updated settings changes.
+- **User**: runs during a user account first run to configure per-user settings.
+
+
+
+
+
+
+
+
+
+## Device provisioning during OOBE
+
+The provisioning engine always applies provisioning packages persisted in the C:\Recovery\Customizations folder on the OS partition. When the provisioning engine applies provisioning packages in the %ProgramData%\Microsoft\Provisioning folder, certain runtime setting applications, such as the setting to install and configure Windows apps, may be extended past the OOBE pass and continually be processed in the background when the device gets to the desktop. Settings for configuring policies and certain crucial system configurations are always be completed before the first point at which they must take effect. 
+
+Device users can apply a provisioning package from a remote source when the device first boots to OOBE. The device provisioning during OOBE is only triggered after the language, locale, time zone, and other settings on the first OOBE UI page are configured. On all Windows devices, device provisioning during OOBE can be triggered by 5 fast taps on the Windows hardware key. When device provisioning is triggered, the provisioning UI is displayed in the OOBE page. The provisioning UI allows users to select a provisioning package acquired from a remote source, such as through NFC or a removable media. 
+
+The following table shows how device provisioning can be initiated when a user first boots to OOBE.
+
+
+| Package delivery | Initiation method | Supported device |
+| --- | --- | --- |
+| Removable media - USB drive or SD card</br> (Packages must be placed at media root) | 5 fast taps on the Windows key to launch the provisioning UI |All Windows devices |
+| From an administrator device through machine to machine NFC or NFC tag</br>(The administrator device must run an app that can transfer the package over NFC) | 5 fast taps on the Windows key to launch the provisioning UI | Windows 10 Mobile devices and IoT Core devices |
+ 
+The provisioning engine always copies the acquired provisioning packages to the %ProgramData%\Microsoft\Provisioning folder before processing them during OOBE. The provisioning engine always applies provisioning packages embedded in the installed Windows image during Windows Setup OOBE pass regardless of whether the package is signed and trusted. When the provisioning engine applies an encrypted provisioning package on an end-user device during OOBE, users must first provide a valid password to decrypt the package. The provisioning engine also checks whether a provisioning package is signed and trusted; if it's not, the user must provide consent before the package is applied to the device. 
+
+When the provisioning engine applies provisioning packages during OOBE, it applies only the runtime settings from the package to the device. Runtime settings can be system-wide configuration settings, including security policy, Windows app install/uninstall, network configuration, bootstrapping MDM enrollment, provisioning of file assets, account and domain configuration, Windows edition upgrade, and more. The provisioning engine also checks for the configuration settings on the device, such as region/locale or SIM card, and applies the multivariant settings with matching condition(s). 
+
+## Device provisioning at runtime
+
+At device runtime, standalone provisioning packages can be applied by user initiation. Only runtime configuration settings including multivariant settings contained in a provisioning package can be applied at device runtime.
+
+The following table shows when provisioning at device runtime can be initiated.
+
+| Package delivery | Initiation method | Supported device |
+| --- | --- | --- |
+| Removable media - USB drive or SD card</br>(Packages must be placed at media root) | **Settings** > **Accounts** > **Access work or school** > **Add or remove a provisioning package** | All Windows devices |
+| Downloaded from a network connection and copied to a local folder | Double-click the package file | Windows 10 for desktop editions devices |
+| From an administrator device connected to the target device through USB tethering | Drag and drop the package file onto the target device | Windows 10 Mobile devices and IoT Core devices |
+
+When applying provisioning packages from a removable media attached to the device, the Settings UI allows viewing contents of a package before selecting the package for provisioning. To minimize the risk of the device being spammed by applying provisioning packages from unknown sources, a provisioning package can be signed and encrypted. Partners can also set policies to limit the application of provisioning packages at device runtime. Applying provisioning packages at device runtime requires administrator privilege. If the package is not signed or trusted, a user must provide consent before the package is applied to the device. If the package is encrypted, a valid password is needed to decrypt the package before it can be applied to the device.
+
+When applying multiple provisioning packages to a device, the provisioning engine resolves settings with conflicting configuration values from different packages by evaluating the package ranking using the combination of package owner type and package rank level defined in the package metadata. A configuration setting applied from a provisioning package with the highest package ranking will be the final value applied to the device.
+
+After a standalone provisioning package is applied to the device, the package is persisted in the %ProgramData%\Microsoft\Provisioning folder on the device. Provisioning packages can be removed by an administrator by using the **Add or remove a provisioning package** available under **Settings** > **Accounts** > **Access work or school**. However, Windows 10 doesn't provide an uninstall option to revert runtime settings when removing a provisioning package from the device.
+
+
+## Learn more
+
+-   Watch the video: [Provisioning Windows 10 Devices with New Tools](https://go.microsoft.com/fwlink/p/?LinkId=615921)
+
+-   Watch the video: [Windows 10 for Mobile Devices: Provisioning Is Not Imaging](https://go.microsoft.com/fwlink/p/?LinkId=615922)
+
+
+## Related topics
+
+- [Provisioning packages for Windows 10](provisioning-packages.md)
+- [Install Windows Imaging and Configuration Designer](provisioning-install-icd.md)
+- [Create a provisioning package](provisioning-create-package.md)
+- [Apply a provisioning package](provisioning-apply-package.md)
+- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md)
+- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
+- [Provision PCs with apps and certificates for initial deployments (advanced provisioning)](provision-pcs-with-apps-and-certificates.md)
+- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
+- [NFC-based device provisioning](provisioning-nfc.md)
+- [Windows ICD command-line interface (reference)](provisioning-command-line.md)
+- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)
+
+
+
+
+ 
+
+ 
+
+
+
+
+

windows/deploy/provisioning-install-icd.md

@@ -0,0 +1,106 @@
+---
+title: Install Windows Imaging and Configuration Designer (Windows 10)
+description: Learn how to install and run Windows ICD. 
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+author: jdeckerMS
+localizationpriority: high
+---
+
+# Install Windows Imaging and Configuration Designer (ICD)
+
+
+**Applies to**
+
+-   Windows 10
+-   Windows 10 Mobile
+
+Use the Windows Imaging and Configuration Designer (ICD) tool in the Windows Assessment and Deployment Kit (ADK) to create provisioning packages to easily configure devices running Windows 10. Windows ICD is primarily designed for use by IT departments for business and educational institutions who need to provision bring-your-own-device (BYOD) and business-supplied devices.
+
+## Supported platforms
+
+Windows ICD can create provisioning packages for Windows 10 desktop and mobile editions, including Windows 10 IoT Core. You can run Windows ICD on the following operating systems:
+
+- Windows 10 - x86 and amd64
+- Windows 8.1 Update - x86 and amd64
+- Windows 8.1 - x86 and amd64
+- Windows 8 - x86 and amd64
+- Windows 7 - x86 and amd64
+- Windows Server 2016
+- Windows Server 2012 R2 Update
+- Windows Server 2012 R2
+- Windows Server 2012
+- Windows Server 2008 R2
+
+## Install Windows ICD
+
+1. Go to [Download the Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) and select **Get Windows ADK** for the version of Windows 10 that you want to create provisioning packages for (version 1511 or version 1607).
+
+    >[!NOTE]
+    >The rest of this procedure uses Windows ADK for Windows 10, version 1607 as an example.
+    
+2. Save **adksetup.exe** and then run it.
+
+3. On the **Specify Location** page, select an installation path and then click **Next**.
+    >[!NOTE]
+    >The estimated disk space listed on this page applies to the full Windows ADK. If you only install Windows ICD, the space requirement is approximately 32 MB.
+4. Make a selection on the **Windows Kits Privacy** page, and then click **Next**.
+
+5. Accept the **License Agreement**, and then click **Next**.
+
+6. On the **Select the features you want to install** page, clear all selections except **Configuration Designer**, and then click **Install**.
+
+    ![Only Configuration Designer selected for installation](images/icd-install.png)
+
+## Current Windows ICD limitations
+
+
+- You can only run one instance of Windows ICD on your computer at a time.
+
+- Be aware that when adding apps and drivers, all files stored in the same folder will be imported and may cause errors during the build process.
+
+- The Windows ICD UI does not support multivariant configurations. Instead, you must use the Windows ICD command-line interface to configure multivariant settings. For more information, see [Create a provisioning package with multivariant settings](provisioning-multivariant.md).
+
+- While you can open multiple projects at the same time within Windows ICD, you can only build one project at a time.
+
+- In order to enable the simplified authoring jscripts to work on a server SKU running Windows ICD, you need to explicitly enable **Allow websites to prompt for information using scripted windows**. Do this by opening Internet Explorer and then navigating to **Settings** > **Internet Options** > **Security**  -> **Custom level** > **Allow websites to prompt for information using scripted windows**, and then choose **Enable**. 
+
+- If you copy a Windows ICD project from one PC to another PC, make sure that all the associated files for the deployment assets, such as apps and drivers, are copied along with the project to the same path as it was on the original PC. 
+
+    For example, when you add a driver to a provisioned package, you must copy the .INF file to a local directory on the PC that is running Windows ICD. If you don't do this, and attempt to use a copied version of this project on a different PC, Windows ICD might attempt to resolve the path to the files that point to the original PC.
+ 
+- **Recommended**: Before starting, copy all source files to the PC running Windows ICD, rather than using external sources like network shares or removable drives. This reduces the risk of interrupting the build process from a temporary network issue or from disconnecting the USB device.
+
+**Next step**: [How to create a provisioning package](provisioning-create-package.md)
+
+## Learn more
+
+-   Watch the video: [Provisioning Windows 10 Devices with New Tools](https://go.microsoft.com/fwlink/p/?LinkId=615921)
+
+-   Watch the video: [Windows 10 for Mobile Devices: Provisioning Is Not Imaging](https://go.microsoft.com/fwlink/p/?LinkId=615922)
+
+## Related topics
+
+- [Provisioning packages for Windows 10](provisioning-packages.md)
+- [How provisioning works in Windows 10](provisioning-how-it-works.md)
+- [Create a provisioning package](provisioning-create-package.md)
+- [Apply a provisioning package](provisioning-apply-package.md)
+- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md)
+- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
+- [Provision PCs with apps and certificates for initial deployments (advanced provisioning)](provision-pcs-with-apps-and-certificates.md)
+- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
+- [NFC-based device provisioning](provisioning-nfc.md)
+- [Windows ICD command-line interface (reference)](provisioning-command-line.md)
+- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)
+
+
+
+ 
+
+ 
+
+
+
+
+

windows/deploy/provisioning-multivariant.md

@@ -0,0 +1,322 @@
+---
+title: Create a provisioning package with multivariant settings (Windows 10)
+description: Create a provisioning package with multivariant settings to customize the provisioned settings.
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+author: jdeckerMS
+localizationpriority: high
+---
+
+# Create a provisioning package with multivariant settings
+
+
+**Applies to**
+
+-   Windows 10
+-   Windows 10 Mobile
+
+Multivariant provisioning packages enable you to create a single provisioning package that can work for multiple locales.
+
+To provision multivariant settings, you must create a provisioning package with defined **Conditions** and **Settings** that are tied to these conditions. When you install this package on a Windows 10 device, the provisioning engine applies the matching condition settings at every event and triggers provisioning.
+
+The following events trigger provisioning on Windows 10 devices:
+
+| Event | Windows 10 Mobile | Windows 10 for desktop editions (Home, Pro, Enterprise, and Education) |
+| --- | --- | --- |
+| System boot | Supported | Supported |
+| Operating system update | Supported | Planned |
+| Package installation during device first run experience | Supported | Supported |
+| Detection of SIM presence or update | Supported | Not supported |
+| Package installation at runtime | Supported | Supported |
+| Roaming detected | Supported | Not supported |
+
+## Target, TargetState, Condition, and priorities
+
+Targets describe keying for a variant and must be described or pre-declared before being referenced by the variant.
+
+- You can define multiple **Target** child elements for each **Id** that you need for the customization setting.
+
+- Within a **Target** you can define multiple **TargetState** elements.
+
+- Within a **TargetState** element you can create multiple **Condition** elements.
+
+- A **Condition** element defines the matching type between the condition and the specified value.
+
+The following table shows the conditions supported in Windows 10 provisioning:
+
+>[!NOTE]
+>You can use any of these supported conditions when defining your **TargetState**.
+
+| Condition Name | Condition priority | Windows 10 Mobile | Windows 10 for desktop editions | Value type | Value description |
+| --- | --- | --- | --- | --- | --- |
+| MNC | P0 | Supported | N/A | Digit string | Use to target settings based on the Mobile Network Code (MNC) value. |
+| MCC | P0 | Supported | N/A | Digit string | Use to target settings based on the Mobile Country Code (MCC) value. |
+| SPN | P0 | Supported | N/A | String | Use to target settings based on the Service Provider Name (SPN) value. |
+| PNN | P0 | Supported | N/A | String | Use to target settings based on public land mobile network (PLMN) Network Name value. |
+| GID1 | P0 | Supported | N/A | Digit string | Use to target settings based on the Group Identifier (level 1) value. |
+| ICCID | P0 | Supported | N/A | Digit string | Use to target settings based on the Integrated Circuit Card Identifier (ICCID) value. |
+| Roaming | P0 | Supported | N/A | Boolean | Use to specify roaming. Set the value to **1** (roaming) or **0** (non-roaming). | 
+| UICC | P0 | Supported | N/A | Enumeration | Use to specify the UICC state. Set the value to one of the following:</br></br></br>- 0 - Empty</br>- 1 - Ready</br>- 2 - Locked |
+| UICCSLOT | P0 | Supported | N/A | Digit string | Use to specify the UICC slot. Set the value one of the following:</br></br></br>- 0 - Slot 0</br>- 1 - Slot 1 |
+| ProcessorType | P1 | Supported | Supported | String | Use to target settings based on the processor type. |
+| ProcessorName | P1 | Supported | Supported | String | Use to target settings based on the processor name. |
+| AoAc | P1 | Supported | Supported | Boolean | Set the value to 0 or 1. |
+| PowerPlatformRole | P1 | Supported | Supported | Enumeration | Indicates the preferred power management profile. Set the value based on the POWER_PLATFORM_ROLE enumeration. |
+| Architecture | P1 | Supported | Supported | String | Matches the PROCESSOR_ARCHITECTURE environment variable. |
+| Server | P1 | Supported | Supported | Boolean | Set the value to 0 or 1. |
+| Region | P1 | Supported | Supported | Enumeration | Use to target settings based on country/region. |
+| Lang | P1 | Supported | Supported | Enumeration | Use to target settings based on language code. |
+| ROMLANG | P1 | Supported | N/A | Digit string | Use to specify the PhoneROMLanguage that's set for DeviceTargeting. This condition is used primarily to detect variants for China. For example, you can use this condition and set the value to "0804". |
+
+The matching types supported in Windows 10 are:
+
+| Matching type | Syntax | Example |
+| --- | --- | --- |
+| Straight match | Matching type is specified as-is | &lt;Condition Name="ProcessorName" Value="Barton" /&gt; |
+| Regex match | Matching type is prefixed by "Pattern:" | &lt;Condition Name="ProcessorName" Value="Pattern:.*Celeron.*" /&gt; |
+| Numeric range match | Matching type is prefixed by "!Range:" | &lt;Condition Name="MNC" Value="!Range:400, 550" /&gt; |
+ 
+
+- When all **Condition** elements are TRUE, **TargetState** is TRUE (**AND** logic).
+
+- If any of the **TargetState** elements is TRUE, **Target** is TRUE (**OR** logic), and **Id** can be used for the setting customization.
+
+
+You can define more than one **TargetState** within a provisioning package to apply variant settings that match device conditions. When the provisioning engine evalues each **TargetState**, more than one **TargetState** may fit current device conditions. To determine the order in which the variant settings are applied, the system assigns a priority to every **TargetState**. 
+
+A variant setting that matches a **TargetState** with a lower priority is applied before the variant that matches a **TargetState** with a higher priority. Variant settings that match more than one **TargetState** with equal priority are applied according to the order that each **TargetState** is defined in the provisioning package.
+
+The **TargetState** priority is assigned based on the conditions priority and the priority evaluation rules are as followed:
+
+1. **TargetState** with P0 conditions is higher than **TargetState** without P0 conditions.
+
+
+2. **TargetState** with P1 conditions is higher than **TargetState** without P0 and P1 conditions.
+
+
+3. If N₁>N₂>0, the **TargetState** priority with N₁ P0 conditions is higher than the **TargetState** with N₂ P1 conditions.
+
+
+4. For **TargetState** without P0 conditions, if N₁>N₂>0 **TargetState** with N₁ P1 conditions is higher than the **TargetState** with N₂ P1 conditions.
+
+
+5. For **TargetState** without P0 and P1 conditions, if N₁>N₂>0 **TargetState** priority with N₁ P2 conditions is higher than the **TargetState** with N₂ P2 conditions.
+
+
+6. For rules 3, 4, and 5, if N₁=N₂, **TargetState** priorities are considered equal.
+
+
+## Create a provisioning package with multivariant settings
+
+Follow these steps to create a provisioning package with multivariant capabilities.
+
+
+1. Build a provisioning package and configure the customizations you need to apply during certain conditions. For more information, see [Create a provisioning package](provisioning-create-package.md).
+
+
+2. After you've [configured the settings](provisioning-create-package.md#configure-settings), save the project.
+
+
+3. Open the project folder and copy the customizations.xml file. 
+
+4. Use an XML or text editor to open the customizations.xml file.
+
+    The customizations.xml file holds the package metadata (including the package owner and rank) and the settings that you configured when you created your provisioning package. The Customizations node contains a Common section, which contains the customization settings.
+
+    The following example shows the contents of a sample customizations.xml file.
+
+    ```XML
+<?xml version="1.0" encoding="utf-8"?> 
+<WindowsCustomizatons> 
+  <PackageConfig xmlns="urn:schemas-Microsoft-com:Windows-ICD-Package-Config.v1.0"> 
+    <ID>{6aaa4dfa-00d7-4aaa-8adf-73c6a7e2501e}</ID> 
+    <Name>My Provisioning Package</Name> 
+    <Version>1.0</Version> 
+    <OwnerType>OEM</OwnerType> 
+    <Rank>50</Rank> 
+  </PackageConfig> 
+  <Settings xmlns="urn:schemas-microsoft-com:windows-provisioning"> 
+    <Customizations> 
+      <Common> 
+        <Policies> 
+          <AllowBrowser>0</AllowBrowser> 
+          <AllowCamera>0</AllowCamera> 
+          <AllowBluetooth>0</AllowBluetooth> 
+        </Policies> 
+        <HotSpot> 
+          <Enabled>0</Enabled> 
+        </HotSpot> 
+      </Common> 
+    </Customizations> 
+  </Settings> 
+</WindowsCustomizatons> 
+    ```
+
+4. Edit the customizations.xml file and create a **Targets** section to describe the conditions that will handle your multivariant settings. 
+
+    The following example shows the customizations.xml, which has been modified to include several conditions including **ProcessorName**, **ProcessorType**, **MCC**, and **MNC**.
+    
+    ```XML
+    <?xml version="1.0" encoding="utf-8"?> 
+<WindowsCustomizatons> 
+  <PackageConfig xmlns="urn:schemas-Microsoft-com:Windows-ICD-Package-Config.v1.0"> 
+    <ID>{6aaa4dfa-00d7-4aaa-8adf-73c6a7e2501e}</ID> 
+    <Name>My Provisioning Package</Name> 
+    <Version>1.0</Version> 
+    <OwnerType>OEM</OwnerType> 
+    <Rank>50</Rank> 
+  </PackageConfig> 
+  <Settings xmlns="urn:schemas-microsoft-com:windows-provisioning"> 
+    <Customizations> 
+      <Common> 
+        <Policies> 
+          <AllowBrowser>0</AllowBrowser> 
+          <AllowCamera>0</AllowCamera> 
+          <AllowBluetooth>0</AllowBluetooth> 
+        </Policies> 
+        <HotSpot> 
+          <Enabled>0</Enabled> 
+        </HotSpot> 
+      </Common> 
+      <Targets> 
+        <Target Id="Unique target identifier for desktop"> 
+          <TargetState> 
+            <Condition Name="ProcessorName" Value="Pattern:.*Celeron.*" /> 
+            <Condition Name="ProcessorType" Value="Pattern:.*(I|i)ntel.*" /> 
+          </TargetState> 
+          <TargetState> 
+            <Condition Name="ProcessorName" Value="Barton" /> 
+            <Condition Name="ProcessorType" Value="Athlon MP" /> 
+          </TargetState> 
+        </Target> 
+        <Target Id="Mobile target"> 
+          <TargetState> 
+            <Condition Name="MCC" Value="Range:310, 320" /> 
+            <Condition Name="MNC" Value="!Range:400, 550" /> 
+          </TargetState> 
+        </Target> 
+      </Targets> 
+    </Customizations> 
+  </Settings> 
+</WindowsCustomizatons> 
+    ```
+
+5. In the customizations.xml file, create a **Variant** section for the settings you need to customize. To do this:
+
+    a. Define a child **TargetRefs** element.
+    
+    b. Within the **TargetRefs** element, define a **TargetRef** element. You can define multiple **TargetRef** elements for each **Id** that you need to apply to customized settings. 
+
+    c. Move compliant settings from the **Common** section to the **Variant** section.
+
+    If any of the TargetRef elements matches the Target, all settings in the Variant are applied (OR logic).
+
+    >[!NOTE]
+    >You can define multiple Variant sections. Settings that reside in the **Common** section are applied unconditionally on every triggering event.
+
+    The following example shows the customizations.xml updated to include a **Variant** section and the moved settings that will be applied if the conditions for the variant are met.
+
+    ```XML
+<?xml version="1.0" encoding="utf-8"?> 
+<WindowsCustomizatons> 
+  <PackageConfig xmlns="urn:schemas-Microsoft-com:Windows-ICD-Package-Config.v1.0">
+    <ID>{6aaa4dfa-00d7-4aaa-8adf-73c6a7e2501e}</ID> 
+    <Name>My Provisioning Package</Name> 
+    <Version>1.0</Version> 
+    <OwnerType>OEM</OwnerType> 
+    <Rank>50</Rank> 
+  </PackageConfig> 
+  <Settings xmlns="urn:schemas-microsoft-com:windows-provisioning"> 
+    <Customizations> 
+      <Common> 
+      </Common> 
+      <Targets> 
+        <Target Id="Unique target identifier for desktop"> 
+          <TargetState> 
+            <Condition Name="ProcessorName" Value="Pattern:.*Celeron.*" /> 
+            <Condition Name="ProcessorType" Value="Pattern:.*(I|i)ntel.*" /> 
+          </TargetState> 
+          <TargetState> 
+            <Condition Name="ProcessorName" Value="Barton" /> 
+            <Condition Name="ProcessorType" Value="Athlon MP" /> 
+          </TargetState> 
+        </Target> 
+        <Target Id="Mobile target"> 
+          <TargetState> 
+            <Condition Name="MCC" Value="Range:310, 320" /> 
+            <Condition Name="MNC" Value="!Range:400, 550" /> 
+          </TargetState> 
+        </Target>
+      </Targets> 
+      <Variant> 
+        <TargetRefs> 
+          <TargetRef Id="Unique target identifier for desktop" /> 
+          <TargetRef Id="Mobile target" /> 
+        </TargetRefs> 
+        <Settings> 
+          <Policies> 
+            <AllowBrowser>1</AllowBrowser> 
+            <AllowCamera>1</AllowCamera> 
+            <AllowBluetooth>1</AllowBluetooth> 
+          </Policies> 
+          <HotSpot> 
+            <Enabled>1</Enabled> 
+          </HotSpot> 
+        </Settings> 
+      </Variant> 
+    </Customizations> 
+  </Settings> 
+</WindowsCustomizatons> 
+    ```
+
+6. Save the updated customizations.xml file and note the path to this updated file. You will need the path as one of the values for the next step.
+
+
+7. Use the [Windows ICD command-line interface](provisioning-command-line.md) to create a provisioning package using the updated customizations.xml. 
+
+    For example:
+
+    ```
+    icd.exe /Build-ProvisioningPackage /CustomizationXML:"C:\CustomProject\customizations.xml" /PackagePath:"C:\CustomProject\output.ppkg" /StoreFile:C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\Microsoft-Common-Provisioning.dat"
+    ```
+    
+
+In this example, the **StoreFile** corresponds to the location of the settings store that will be used to create the package for the required Windows edition. 
+
+>[!NOTE]
+>The provisioning package created during this step will contain the multivariant settings. You can use this package either as a standalone package that you can apply to a Windows device or use it as the base when starting another project.
+
+ 
+
+
+ 
+
+ 
+
+
+
+
+
+ 
+
+## Related topics
+
+- [Provisioning packages for Windows 10](provisioning-packages.md)
+- [How provisioning works in Windows 10](provisioning-how-it-works.md)
+- [Install Windows Imaging and Configuration Designer](provisioning-install-icd.md)
+- [Create a provisioning package](provisioning-create-package.md)
+- [Apply a provisioning package](provisioning-apply-package.md)
+- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md)
+- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
+- [Provision PCs with apps and certificates for initial deployments (advanced provisioning)](provision-pcs-with-apps-and-certificates.md)
+- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
+- [NFC-based device provisioning](provisioning-nfc.md)
+- [Windows ICD command-line interface (reference)](provisioning-command-line.md)
+
+ 
+
+
+
+
+

windows/deploy/provisioning-nfc.md

@@ -0,0 +1,153 @@
+---
+title: NFC-based device provisioning (Windows 10)
+description: 
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+author: jdeckerMS
+localizationpriority: high
+---
+
+# NFC-based device provisioning
+
+
+**Applies to**
+
+-   Windows 10 Mobile
+
+Near field communication (NFC) enables Windows 10 Mobile Enterprise and Windows 10 Mobile devices to communicate with an NFC tag or another NFC-enabled transmitting device. Enterprises that do bulk provisioning can use NFC-based device provisioning to provide a provisioning package to the device that's being provisioned. NFC provisioning is simple and convenient and it can easily store an entire provisioning package. 
+
+The NFC provisioning option enables the administrator to provide a provisioning package during initial device setup or the out-of-box experience (OOBE) phase. Administrators can use the NFC provisioning option to transfer provisioning information to persistent storage by tapping an unprovisioned mobile device to an NFC tag or NFC-enabled device. To use NFC for pre-provisioning a device, you must either prepare your own NFC tags by storing your provisioning package to a tag as described in this section, or build the infrastructure needed to transmit a provisioning package between an NFC-enabled device and a mobile device during OOBE.
+
+## Provisioning OOBE UI
+
+All Windows 10 Mobile Enterprise and Windows 10 Mobile images have the NFC provisioning capability incorporated into the operating system. On devices that support NFC and are running Windows 10 Mobile Enterprise or Windows 10 Mobile, NFC-based device provisioning provides an additional mechanism to provision the device during OOBE.
+
+On all Windows devices, device provisioning during OOBE can be triggered by 5 fast taps on the Windows hardware key, which shows the **Provision this device** screen. In the **Provision this device** screen, select **NFC** for NFC-based provisioning. 
+
+![Example of Provision this device screen](images/nfc.png)
+
+If there is an error during NFC provisioning, the device will show a message if any of the following errors occur:
+
+- **NFC initialization error** - This can be caused by any error that occurs before data transfer has started. For example, if the NFC driver isn't enabled or there's an error communicating with the proximity API.
+- **Interrupted download or incomplete package transfer** - This error can happen if the peer device is out of range or the transfer is aborted. This error can be caused whenever the device being provisioned fails to receive the provisioning package in time.
+- **Incorrect package format** - This error can be caused by any protocol error that the operating system encounters during the data transfer between the devices.
+- **NFC is disabled by policy** - Enterprises can use policies to disallow any NFC usage on the managed device. In this case, NFC functionality is not enabled.
+
+## NFC tag
+
+You can use an NFC tag for minimal provisioning and use an NFC-enabled device tag for larger provisioning packages.
+
+The protocol used for NFC-based device provisioning is similar to the one used for NFC provisioning on Windows Embedded 8.1 Handheld, which supported both single-chunk and multi-chunk transfer when the total transfer didn't fit in one NDEP message size. In Windows 10, the provisioning stack contains the following changes:
+
+- **Protocol namespace** - The protocol namespace has changed from Windows.WEH.PreStageProv.Chunk to Windows.ProvPlugins.Chunk.
+- **Tag data type** - The tag data type has changed from UTF-8 into binary raw data.
+
+
+>[!NOTE]
+>The NFC tag doesn't go in the secondary device. You can transfer the NFC tag by using a provisioning package from device-to-device using the NFC radio or by re-reading the provisioning package from an NFC tag.
+
+### NFC tag components
+
+NFC tags are suitable for very light applications where minimal provisioning is required. The size of NFC tags that contain provisioning packages is typically 4 KB to 10 KB. 
+
+To write to an NFC tag, you will need to use an NFC Writer tool, or you can use the [ProximityDevice class API](https://msdn.microsoft.com/library/windows/apps/windows.networking.proximity.proximitydevice.aspx) to write your own custom tool to transfer your provisioning package file to your NFC tag. The tool must publish a binary message (write) a Chunk data type to your NFC tag.
+
+The following table describes the information that is required when writing to an NFC tag.
+
+| Required field | Description |
+| --- | --- |
+| **Type** | Windows.ProvPlugins.Chunk<br></br>The receiving device uses this information to understand information in the Data field. |
+| **Data** | Tag data with small header in raw binary format that contains a chunk of the provisioning package to be transferred. |
+ 
+
+
+### NFC provisioning helper
+
+The NFC provisioning helper device must split the provisioning package raw content into multiple parts and publish these in order. Each part should follow the following format:
+
+<table><tr><td>**Version**</br>(1 byte)</td><td>**Leading**<br>(1 byte)</td><td>**Order**</br>(1 byte)</td><td>**Total**</br>(1 byte)</td><td>**Chunk payload**</br>(N bytes)</td></tr></table>
+ 
+For each part:
+- **Version** should always be 0x00.
+- **Leading byte** should always be 0xFF.
+- **Order** represents which message chunk (out of the whole message) the part belongs to. The Order begins with zero (0). 
+- **Total** represents the total number of chunks to be transferred for the whole message.
+- **Chunk payload** represents each of the split parts.
+
+The NFC provisioning helper device must publish the record in a type of Windows.ProvPlugins.Chunk.
+
+**Code example**
+
+The following example shows how to write to an NFC tag. This example assumes that the tag is already in range of the writing device.
+
+```
+        private async void WriteProvPkgToTag(IStorageFile provPkgFile)
+        {
+            var buffer = await FileIO.ReadBufferAsync(provPkgFile);
+            if (null == buffer)
+            {
+                return;
+            }
+
+            var proximityDevice = Windows.Networking.Proximity.ProximityDevice.GetDefault();
+            if (null == proximityDevice)
+            {
+                return;
+            }
+
+            var dataWriter = new DataWriter();
+            var header = new NfcProvHeader();
+
+            header.version = NFC_PROV_MESSAGE_CURRENT_VERSION;  // Currently the supported version is 0x00.
+            header.leading = NFC_PROV_MESSAGE_LEADING_BYTE;     // The leading byte should be always 0xFF.
+            header.index = 0; // Assume we only have 1 chunk.
+            header.total = 1; // Assume we only have 1 chunk.
+
+            // Write the header first and then the raw data of the provisioning package.
+            dataWriter.WriteBytes(GetBytes(header));
+            dataWriter.WriteBuffer(buffer);
+
+            var chunkPubId = proximityDevice.PublishBinaryMessage(
+                            "Windows:WriteTag.ProvPlugins.Chunk",
+                            dataWriter.DetachBuffer());
+        }
+```
+
+
+### NFC-enabled device tag components
+
+Provisioning from an NFC-enabled source device allows for larger provisioning packages than can be transferred using an NFC tag. When provisioning from an NFC-enabled device, we recommend that the total file size not exceed 120 KB. Be aware that the larger the NFC file is, the longer it will take to transfer the provisioning file. Depending on your NFC hardware, the transfer time for a 120 KB file will vary between 2.5 seconds and 10 seconds.
+
+To provision from an NFC-enabled source device, use [ProximityDevice class API](https://msdn.microsoft.com/library/windows/apps/windows.networking.proximity.proximitydevice.aspx) to write your own custom tool that transfers your provisioning package in chunks to your target mobile device. The tool must publish binary messages (transmit) a Header message, followed by one or more Chunk messages. The Header specifies the total amount of data that will be transferred to the target device; the Chunks must contain binary raw data formatted provisioning data, as shown in the NFC tag components section.
+
+For detailed information and code samples on how to implement an NFC-enabled device tag, see **ConvertToNfcMessageAsync** in [this GitHub NfcProvisioner Universal Windows app example](https://github.com/Microsoft/Windows-universal-samples/blob/master/Samples/NfcProvisioner/cs/Scenario1.xaml.cs). The sample app shows you how to host the provisioning package on a master device so that you can transfer it to the receiving device.
+
+ 
+
+
+
+
+
+## Related topics
+
+- [Provisioning packages for Windows 10](provisioning-packages.md)
+- [How provisioning works in Windows 10](provisioning-how-it-works.md)
+- [Install Windows Imaging and Configuration Designer](provisioning-install-icd.md)
+- [Create a provisioning package](provisioning-create-package.md)
+- [Apply a provisioning package](provisioning-apply-package.md)
+- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md)
+- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
+- [Provision PCs with apps and certificates for initial deployments (advanced provisioning)](provision-pcs-with-apps-and-certificates.md)
+- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
+- [Windows ICD command-line interface (reference)](provisioning-command-line.md)
+- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)
+
+ 
+
+ 
+
+
+
+
+

windows/deploy/provisioning-packages.md

@@ -3,9 +3,8 @@ title: Provisioning packages (Windows 10)
 description: With Windows 10, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image.
 ms.assetid: 287706E5-063F-4AB5-902C-A0DF6D0730BC
 ms.prod: w10
-ms.mktglfcycl: explore
+ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.pagetype: mobile
 author: jdeckerMS
 localizationpriority: high
 ---
@@ -18,15 +17,17 @@ localizationpriority: high
 -   Windows 10
 -   Windows 10 Mobile
 
-Windows provisioning makes it easy for IT administrators to configure end-user devices without imaging. Using Windows Provisioning, an IT administrator can easily specify desired configuration and settings required to enroll the devices into management (through a wizard-driven user interface) and then apply that configuration to target devices in a matter of minutes. It is best suited for small- to medium-sized businesses with deployments that range from tens to a few hundred computers. 
+Windows provisioning makes it easy for IT administrators to configure end-user devices without imaging. Using Windows provisioning, an IT administrator can easily specify desired configuration and settings required to enroll the devices into management and then apply that configuration to target devices in a matter of minutes. It is best suited for small- to medium-sized businesses with deployments that range from tens to a few hundred computers. 
 
-With Windows 10, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image.
+A provisioning package (.ppkg) is a container for a collection of configuration settings. With Windows 10, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image.
 
 Provisioning packages are simple enough that with a short set of written instructions, a student or non-technical employee can use them to configure their device. This can result in a significant reduction in the time required to configure multiple devices in your organization.
 
+The [Windows Assessment and Deployment Kit (ADK) for Windows 10](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) includes the Imaging and Configuration Designer (ICD), a tool for configuring provisioning packages. 
+
 ## New in Windows 10, Version 1607
 
-The Windows Assessment and Deployment Kit (ADK) for Windows 10 includes the Imaging and Configuration Designer (ICD), a tool for configuring images and runtime settings which are then built into provisioning packages. Windows ICD for Windows 10, Version 1607, simplifies common provisioning scenarios. 
+Windows ICD for Windows 10, Version 1607, simplifies common provisioning scenarios. 
 
 ![Configuration Designer options](images/icd.png)
 
@@ -74,7 +75,7 @@ Provisioning packages can be:
 ## What you can configure
 
 
-The following table provides some examples of what can be configured using provisioning packages.
+The following table provides some examples of what you can configure using provisioning packages.
 
 | Customization options    | Examples                                                                                      |
 |--------------------------|-----------------------------------------------------------------------------------------------|
@@ -92,42 +93,26 @@ The following table provides some examples of what can be configured using provi
 
 For details about the settings you can customize in provisioning packages, see [Windows Provisioning settings reference]( https://go.microsoft.com/fwlink/p/?LinkId=619012).
 
-## Creating a provisioning package
-
-
-With Windows 10, you can use the Windows Imaging and Configuration Designer (ICD) tool to create provisioning packages. To install Windows ICD and create provisioning packages, you must [install the Windows Assessment and Deployment Kit (ADK) for Windows 10](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit).
-
-When you run ADKsetup.exe for Windows 10, version 1607, select the following feature from the **Select the features you want to install** dialog box:
-
--   **Configuration Designer**
-
-![Choose Configuration Designer](images/adk-install.png)
-
-> [!NOTE]
-> In previous versions of the Windows 10 ADK, you had to install additional features for Windows ICD to run. Starting in version 1607, you can install Windows ICD without other ADK features.
-
-After you install Windows ICD, you can use it to create a provisioning package. For detailed instructions on how to create a provisioning package, see [Build and apply a provisioning package](https://go.microsoft.com/fwlink/p/?LinkID=629651).
-
-## Applying a provisioning package to a device
-
-
-Provisioning packages can be applied both during image deployment and during runtime. For information on how to apply a provisioning package to a Windows 10-based device, see [Build and apply a provisioning package](https://go.microsoft.com/fwlink/p/?LinkID=629651).
-
 ## Learn more
 
+-   Watch the video: [Provisioning Windows 10 Devices with New Tools](https://go.microsoft.com/fwlink/p/?LinkId=615921)
 
-[Windows 10: Deployment](https://go.microsoft.com/fwlink/p/?LinkId=533708)
+-   Watch the video: [Windows 10 for Mobile Devices: Provisioning Is Not Imaging](https://go.microsoft.com/fwlink/p/?LinkId=615922)
 
 ## Related topics
 
-- [Provision PCs with common settings for initial deployment](provision-pcs-for-initial-deployment.md)
-- [Provision PCs with apps and certificates for initial deployments](provision-pcs-with-apps-and-certificates.md)
-- [Configure devices without MDM](../manage/configure-devices-without-mdm.md)
-- [Set up a shared or guest PC with Windows 10](../manage/set-up-shared-or-guest-pc.md)
-- [Configure devices without MDM](../manage/configure-devices-without-mdm.md)
-- [Set up a device for anyone to use (kiosk mode)](../manage/set-up-a-device-for-anyone-to-use.md)
-- [Customize Windows 10 Start and taskbar with ICD and provisioning packages](../manage/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md)
-- [Set up student PCs to join domain](https://technet.microsoft.com/edu/windows/set-up-students-pcs-to-join-domain)
+- [How provisioning works in Windows 10](provisioning-how-it-works.md)
+- [Install Windows Imaging and Configuration Designer](provisioning-install-icd.md)
+- [Create a provisioning package](provisioning-create-package.md)
+- [Apply a provisioning package](provisioning-apply-package.md)
+- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md)
+- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
+- [Provision PCs with apps and certificates for initial deployments (advanced provisioning)](provision-pcs-with-apps-and-certificates.md)
+- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
+- [NFC-based device provisioning](provisioning-nfc.md)
+- [Windows ICD command-line interface (reference)](provisioning-command-line.md)
+- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)
+
 
 
 

windows/deploy/provisioning-script-to-install-app.md

@@ -0,0 +1,222 @@
+---
+title: Use a script to install a desktop app in provisioning packages (Windows 10)
+description: With Windows 10, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image.
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+author: jdeckerMS
+localizationpriority: high
+---
+
+# Use a script to install a desktop app in provisioning packages
+
+
+**Applies to**
+
+-   Windows 10
+-   Windows 10 Mobile
+
+This walkthrough describes how to leverage the ability to include scripts in a Windows 10 provisioning package to install Win32 applications. Scripted operations other than installing apps can also be performed, however, some care is needed in order to avoid unintended behavior during script execution (see Remarks below). 
+
+>**Prerequisite**: [Windows Assessment and Deployment Kit (ADK) for Windows 10](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit), version 1511 or higher 
+
+>[!NOTE]
+>This scenario is only supported for installing applications on Windows 10 for desktop, version 1511 or higher.
+
+## Assemble the application assets
+
+1. On the device where you’re authoring the package, place all of your assets in a known location. Each asset must have a unique filename, because all files will be copied to the same temp directory on the device. It’s common for many apps to have an installer called ‘install.exe’ or similar, and there may be name overlap because of that. To fix this, you can use the technique described in the next step to include a complete directory structure that is then expanded into the temp directory on the device. The most common use for this would be to include a subdirectory for each application. 
+
+2. If you need to include a directory structure of files, you will need to cab the assets for easy inclusion in the provisioning packages.
+
+## Cab the application assets
+
+1. Create a .DDF file as below, replacing *file1* and *file2* with the files you want to package, and adding the name of file/directory.
+
+    ```
+    ;*** MSDN Sample Source Code MakeCAB Directive file example
+    
+    ;
+    
+    .OPTION EXPLICIT  ; Generate errors on variable typos
+    
+    .set DiskDirectoryTemplate=CDROM  ; All cabinets go in a single directory
+    
+    .Set MaxDiskFileCount=1000; Limit file count per cabinet, so that
+    
+    ; scanning is not too slow
+    
+    .Set FolderSizeThreshold=200000   ; Aim for ~200K per folder
+    
+    .Set CompressionType=MSZIP
+    
+    ;** All files are compressed in cabinet files
+    
+    .Set Cabinet=on
+    
+    .Set Compress=on
+    
+    ;-------------------------------------------------------------------
+    
+    ;** CabinetNameTemplate = name of cab
+    
+    ;** DiskDirectory1 = output directory where cab will be created
+    
+    ;-------------------------------------------------------------------
+    
+    .Set CabinetNameTemplate=tt.cab
+    
+    .Set DiskDirectory1=.
+        
+    ;-------------------------------------------------------------------
+    
+    ; Replace <file> with actual files you want to package
+    
+    ;-------------------------------------------------------------------
+    
+    <file1>
+    
+    <file2>
+    
+    ;*** <the end>  
+    ```
+
+2. Use makecab to create the cab files.
+
+    ```
+    Makecab -f <path to DDF file>
+    ```
+
+## Create the script to install the application
+
+Create a script to perform whatever work is needed to install the application(s). The following examples are provided to help get started authoring the orchestrator script that will execute the required installers. In practice, the orchestrator script may reference many more assets than those in these examples.
+
+>[!NOTE]
+>All actions performed by the script must happen silently, showing no UI and requiring no user interaction.
+>
+>The scripts will be run on the device in system context.
+
+### Debugging example 
+
+Granular logging is not built in, so the logging must be built into the script itself. Here is an example script that logs ‘Hello World’ to a logfile. When run on the device, the logfile will be available after provisioning is completed. As you will see in the following examples, it’s recommended that you log each action that your script performs.
+
+```
+set LOGFILE=%SystemDrive%\HelloWorld.log
+echo Hello, World >> %LOGFILE% 
+```
+### .exe example
+
+This example script shows how to create a log output file on the system drive, install an app from a .exe installer, and echo the results to the log file.
+
+```
+set LOGFILE=%SystemDrive%\Fiddler_install.log
+echo Installing Fiddler.exe >> %LOGFILE%
+fiddler4setup.exe /S >> %LOGFILE%
+echo result: %ERRORLEVEL% >> %LOGFILE%
+```
+
+### .msi example
+
+This is the same as the previous installer, but installs the app from an MSI installer. Notice that msiexec is called with the /quiet flag in order to meet the silent requirement of scripts run from within a provisioning package.
+
+```
+set LOGFILE=%SystemDrive%\IPOverUsb_install.log
+echo Installing IpOverUsbInstaller.msi >> %LOGFILE%
+msiexec /i IpOverUsbInstaller.msi /quiet >> %LOGFILE%
+echo result: %ERRORLEVEL% >> %LOGFILE%
+```
+
+### PowerShell example
+
+This is an example script with logging that shows how to run a powershell script from the provisioning commands setting. Note that the PowerShell script referenced from this example must also be included in the package, and obey the same requirements as all scripts run from within the provisioning package: it must execute silently, with no user interaction.
+
+```
+set LOGFILE=%SystemDrive%\my_powershell_script.log
+echo Running my_powershell_script.ps1 in system context >> %LOGFILE%
+echo Executing "PsExec.exe -accepteula -i -s cmd.exe /c powershell.exe my_powershell_script.ps1" >> %LOGFILE%
+PsExec.exe -accepteula -i -s cmd.exe /c powershell.exe my_powershell_script.ps1' >> %LOGFILE%
+echo result: %ERRORLEVEL% >> %LOGFILE%
+```
+
+### Extract from a .CAB example
+
+This example script shows expansion of a .cab from the provisioning commands script, as well as installation of the expanded setup.exe
+
+```
+set LOGFILE=%SystemDrive%\install_my_app.log
+echo Expanding installer_assets.cab >> %LOGFILE%
+expand -r installer_assets.cab -F:* . >> %LOGFILE%
+echo result: %ERRORLEVEL% >> %LOGFILE%
+echo Installing MyApp >> %LOGFILE%
+setup.exe >> %LOGFILE%
+echo result: %ERRORLEVEL% >> %LOGFILE%
+```
+
+### Calling multiple scripts in the package
+
+You are currently allowed one CommandLine per PPKG. The batch files shown above are orchestrator scripts that manage the installation and calls any other scripts included in the PPKG. The orchestrator script is what should be invoked from the CommandLine specified in the package. 
+
+Here’s a table describing this relationship, using the PowerShell example from above:
+
+
+|ICD Setting | Value  | Description |
+| --- | --- | --- |
+| ProvisioningCommands/DeviceContext/CommandLine | cmd /c PowerShell_Example.bat | The command line needed to invoke the orchestrator script. |
+| ProvisioningCommands/DeviceContext/CommandFiles | PowerShell_Example.bat | The single orchestrator script referenced by the command line that handles calling into the required installers or performing any other actions such as expanding cab files. This script must do the required logging. |
+| ProvisioningCommands/DeviceContext/CommandFiles | my_powershell_script.ps1 | Other assets referenced by the orchestrator script. In this example there is only one, but there could be many assets referenced here. One common use case is using the orchestrator to call a series of install.exe or setup.exe installers to install several applications. Each of those installers must be included as an asset here. |
+
+ 
+### Add script to provisioning package 
+ 
+When you have the batch file written and the referenced assets ready to include, you can add them to a provisioning package in the Window Imaging and Configuration Designer (Windows ICD). 
+
+Using ICD, specify the full details of how the script should be run in the CommandLine setting in the provisioning package. This includes flags or any other parameters that you would normally type on the command line. So for example if the package contained an app installer called install.exe and a script used to automate the install called InstallMyApp.bat, the `ProvisioningCommands/DeviceContext/CommandLine` setting should be configured to: 
+
+```
+cmd /c InstallMyApp.bat
+```
+
+In ICD, this looks like:
+
+![Command line in Selected customizations](images/icd-script1.png)
+
+You also need to add the relevant assets for that command line including the orchestrator script and any other assets it references such as installers or .cab files.
+
+In ICD, that is done by adding files under the `ProvisioningCommands/DeviceContext/CommandFiles` setting.
+
+![Command files in Selected customizations](images/icd-script2.png)
+
+When you are done, [build the package](provisioning-create-package.md#build-package). 
+ 
+
+### Remarks
+1. No user interaction or console output is supported via ProvisioningCommands. All work needs to be silent. If your script attempts to do any of the following it will cause undefined behavior, and could put the device in an unrecoverable state if executed during setup or the Out of Box Experience:
+    a. Echo to console
+    b. Display anything on the screen
+    c. Prompt the user with a dialog or install wizard
+2. When applied at first boot, provisioning runs early in the boot sequence and before a user context has been established; care must be taken to only include installers that can run at this time. Other installers can be provisioned via a management tool.
+3. If the device is put into an unrecoverable state because of a bad script, you can reset it using [recovery options in Windows 10](https://support.microsoft.com/help/12415/windows-10-recovery-options).
+4. The CommandFile assets are deployed on the device to a temporary folder unique to each package.
+    a. For packages added during the out of box experience, this is usually in `%WINDIR%\system32\config\systemprofile\appdata\local\Temp\ProvisioningPkgTmp\<{PackageIdGuid}>\Commands`
+    b. For packages added by double-clicking on an already deployed device, this will be in the temp folder for the user executing the PPKG: `%TMP%\ProvisioningPkgTmp\<{PackageIdGuid}>\Commands`
+5. The command line will be executed with the directory the CommandFiles were deployed to as the working directory. This means you do not need to specific the full path to assets in the command line or from within any script.
+6. The runtime provisioning component will attempt to run the scripts from the PPKG at the earliest point possible, depending on the stage when the PPKG was added. For example, if the package was added during the Out-of-Box Experience, it will be run immediately after the package is applied, while the Out-of-Box Experience is still happening. This is before the user account configuration options are presented to the user. A spinning progress dialog will appear and “please wait” will be displayed on the screen. 
+
+    >[!NOTE]
+    >There is a timeout of 30 minutes for the provisioning process at this point. All scripts and installs need to complete within this time. 
+7. The scripts are executed in the background as the rest of provisioning continues to run. For packages added on existing systems using the double-click to install, there is no notification that provisioning or script execution has completed
+
+
+## Related topics
+
+- [Provisioning packages for Windows 10](provisioning-packages.md)
+- [How provisioning works in Windows 10](provisioning-how-it-works.md)
+- [Install Windows Imaging and Configuration Designer](provisioning-install-icd.md)
+- [Create a provisioning package](provisioning-create-package.md)
+- [Apply a provisioning package](provisioning-apply-package.md)
+- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md)
+- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
+- [Provision PCs with apps and certificates for initial deployments (advanced provisioning)](provision-pcs-with-apps-and-certificates.md)
+- [NFC-based device provisioning](provisioning-nfc.md)
+- [Windows ICD command-line interface (reference)](provisioning-command-line.md)
+- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)

windows/deploy/provisioning-uninstall-package.md

@@ -0,0 +1,98 @@
+---
+title: Settings changed when you uninstall a provisioning package (Windows 10)
+description: This topic lists the settings that are reverted when you uninstall a provisioning package.
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+author: jdeckerMS
+localizationpriority: high
+---
+
+# Settings changed when you uninstall a provisioning package
+
+
+**Applies to**
+
+-   Windows 10
+-   Windows 10 Mobile
+
+When you uninstall a provisioning package, only certain settings are revertible. This topic lists the settings that are reverted when you uninstall a provisioning package.
+
+
+As an administrator, you can uninstall by using the **Add or remove a package for work or school** option available under **Settings** > **Accounts** > **Access work or school**.
+
+When a provisioning package is uninstalled, some of its settings are reverted, which means the value for the setting is changed to the next available or default value. Not all settings, however, are revertible. 
+
+Only settings in the following lists are revertible. 
+
+## Registry-based settings
+
+The registry-based settings that are revertible when a provisioning package is uninstalled all fall under these categories, which you can find in the Graphical User Interface of the Windows Imaging and Configuration Designer (Windows ICD). 
+
+
+- [Wi-Fi Sense](https://msdn.microsoft.com/library/windows/hardware/mt219706.aspx)
+- [CountryAndRegion](https://msdn.microsoft.com/library/windows/hardware/mt219726.aspx)
+- DeviceManagement / PGList/ LogicalProxyName
+- UniversalAppInstall / LaunchAppAtLogin
+- [Power](https://msdn.microsoft.com/library/windows/hardware/dn953704.aspx)
+- [TabletMode](https://msdn.microsoft.com/library/windows/hardware/mt297550.aspx) 
+- [Maps](https://msdn.microsoft.com/library/windows/hardware/mt131464.aspx) 
+- [Browser](https://msdn.microsoft.com/library/windows/hardware/mt573151.aspx)
+- [DeviceFormFactor](https://msdn.microsoft.com/library/windows/hardware/mt243449.aspx) 
+- [USBErrorsOEMOverride](https://msdn.microsoft.com/library/windows/hardware/mt769908.aspx) 
+- [WeakCharger](https://msdn.microsoft.com/library/windows/hardware/mt346401.aspx) 
+
+
+
+## CSP-based settings
+
+Here is the list of revertible settings based on configuration service providers (CSPs). 
+
+[ActiveSync CSP](https://msdn.microsoft.com/library/windows/hardware/dn920017.aspx) 
+[AppLocker CSP](https://msdn.microsoft.com/library/windows/hardware/dn920019.aspx)  
+[BrowserFavorite CSP](https://msdn.microsoft.com/library/windows/hardware/dn914758.aspx)   
+[CertificateStore CSP](https://msdn.microsoft.com/library/windows/hardware/dn920021.aspx) 
+[ClientCertificateInstall CSP](https://msdn.microsoft.com/library/windows/hardware/dn920023.aspx)   
+[RootCATrustedCertificates CSP](https://msdn.microsoft.com/library/windows/hardware/dn904970.aspx)   
+[CM_CellularEntries CSP](https://msdn.microsoft.com/library/windows/hardware/dn914761.aspx)   
+[CM_ProxyEntries CSP](https://msdn.microsoft.com/library/windows/hardware/dn914762.aspx)   
+[CMPolicy CSP](https://msdn.microsoft.com/library/windows/hardware/dn914760.aspx)   
+[CMPolicyEnterprise CSP](https://msdn.microsoft.com/library/windows/hardware/mt706463.aspx)   
+[EMAIL2 CSP](https://msdn.microsoft.com/library/windows/hardware/dn904953.aspx)   
+[EnterpriseAPN CSP](https://msdn.microsoft.com/library/windows/hardware/dn958617.aspx)   
+[EnterpriseAppManagement CSP](https://msdn.microsoft.com/library/windows/hardware/dn904955.aspx)   
+[EnterpriseDesktopAppManagement CSP](https://msdn.microsoft.com/library/windows/hardware/dn958620.aspx)   
+[EnterpriseModernAppManagement CSP](https://msdn.microsoft.com/library/windows/hardware/dn904956.aspx)   
+[NAP CSP](https://msdn.microsoft.com/library/windows/hardware/dn914767.aspx)   
+[PassportForWork CSP](https://msdn.microsoft.com/library/windows/hardware/dn987099.aspx)   
+[Provisioning CSP](https://msdn.microsoft.com/library/windows/hardware/mt203665.aspx)   
+[PROXY CSP](https://msdn.microsoft.com/library/windows/hardware/dn914770.aspx)   
+[SecureAssessment CSP](https://msdn.microsoft.com/library/windows/hardware/mt718628.aspx)   
+[VPN CSP](https://msdn.microsoft.com/library/windows/hardware/dn904978.aspx)   
+[VPNv2 CSP](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx)   
+[WiFi CSP](https://msdn.microsoft.com/library/windows/hardware/dn904981.aspx)   
+
+
+
+## Related topics
+
+- [Provisioning packages for Windows 10](provisioning-packages.md)
+- [How provisioning works in Windows 10](provisioning-how-it-works.md)
+- [Install Windows Imaging and Configuration Designer](provisioning-install-icd.md)
+- [Create a provisioning package](provisioning-create-package.md)
+- [Apply a provisioning package](provisioning-apply-package.md)
+- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
+- [Provision PCs with apps and certificates for initial deployments (advanced provisioning)](provision-pcs-with-apps-and-certificates.md)
+- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
+- [NFC-based device provisioning](provisioning-nfc.md)
+- [Windows ICD command-line interface (reference)](provisioning-command-line.md)
+- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)
+
+ 
+
+ 
+
+
+
+
+

windows/deploy/upgrade-analytics-get-started.md

@@ -1,4 +1,4 @@
----
+---
 title: Get started with Upgrade Analytics (Windows 10)
 description: Explains how to get started with Upgrade Analytics.
 ms.prod: w10
@@ -53,7 +53,7 @@ If you are not using OMS:
 
 After you’ve signed in to Operations Management Suite and added the Upgrade Analytics solution to your workspace, complete the following tasks to establish communication and enable data sharing between user computers, Microsoft secure data centers, and Upgrade Analytics.
 
-## Generate your commercial ID key 
+## Generate your commercial ID key
 
 Microsoft uses a unique commercial ID to map information from user computers to your OMS workspace. Generate your commercial ID key in OMS and then deploy it to user computers.
 
@@ -77,14 +77,14 @@ For Upgrade Analytics to receive and display upgrade readiness data from Microso
 
 To enable data sharing, whitelist the following endpoints. Note that you may need to get approval from your security group to do this.
 
-Note: The compatibility update KB runs under the computer’s system account and does not support user authenticated proxies.
+Note: The compatibility update KB runs under the computer’s system account. If you are using user authenticated proxies, read [this blog post](https://go.microsoft.com/fwlink/?linkid=838688) to learn what you need to do to run it under the logged on user account.
 
 | **Endpoint**  | **Function**  |
 |---------------------------------------------------------|-----------|
-| `https://v10.vortex-win.data.microsoft.com/collect/v1`                                                                                                                             | Connected User Experience and Telemetry component endpoint. User computers send data to Microsoft through this endpoint.             |
-| `https://settings-win.data.microsoft.com/settings`                                                                                                                                 | Enables the compatibility update KB to send data to Microsoft.                                                                       |
-| `https://go.microsoft.com/fwlink/?LinkID=544713`<br>`https://compatexchange1.trafficmanager.net/CompatibilityExchangeService.svc/extended`                                        | This service provides driver information about whether there will be a driver available post-upgrade for the hardware on the system. |
-| `https://vortex.data.microsoft.com/health/keepalive` <br>`https://settings.data.microsoft.com/qos` <br>`https://compatexchange1.trafficmanager.net/CompatibilityExchangeService.svc` | These endpoints are used to validate that user computers are sharing data with Microsoft.                                            |
+| `https://v10.vortex-win.data.microsoft.com/collect/v1`  <br><br>                       `https://Vortex-win.data.microsoft.com/health/keepalive`                                                                                                      | Connected User Experience and Telemetry component endpoint. User computers send data to Microsoft through this endpoint.             |
+| `https://settings.data.microsoft.com/qos`                                                                                                                                  | Enables the compatibility update KB to send data to Microsoft.                                                                       |
+| `https://go.microsoft.com/fwlink/?LinkID=544713`<br>`https://compatexchange1.trafficmanager.net/CompatibilityExchangeService.svc`                                         | This service provides driver information about whether there will be a driver available post-upgrade for the hardware on the system. |
+
 
 ## Deploy the compatibility update and related KBs
 
@@ -92,8 +92,8 @@ The compatibility update KB scans your computers and enables application usage t
 
 | **Operating System** | **KBs** |
 |----------------------|-----------------------------------------------------------------------------|
-| Windows 8.1          | [KB 2976978](http://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB2976978)<br>Performs diagnostics on the Windows 8.1 systems that participate in the Windows Customer Experience Improvement Program. These diagnostics help determine whether compatibility issues may be encountered when the latest Windows operating system is installed. <br>For more information about this KB, see <https://support.microsoft.com/kb/2976978><br>[KB 3150513](https://catalog.update.microsoft.com/v7/site/Search.aspx?q=3150513)<br>Provides updated configuration and definitions for compatibility diagnostics performed on the system.<br>For more information about this KB, see <https://support.microsoft.com/kb/3150513><br>NOTE: KB2976978 must be installed before you can download and install KB3150513.   |
-| Windows 7 SP1        | [KB2952664](http://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB2952664) <br>Performs diagnostics on the Windows 7 SP1 systems that participate in the Windows Customer Experience Improvement Program. These diagnostics help determine whether compatibility issues may be encountered when the latest Windows operating system is installed. <br>For more information about this KB, see <https://support.microsoft.com/kb/2952664><br>[KB 3150513](https://catalog.update.microsoft.com/v7/site/Search.aspx?q=3150513)<br>Provides updated configuration and definitions for compatibility diagnostics performed on the system.<br>For more information about this KB, see <https://support.microsoft.com/kb/3150513><br>NOTE: KB2952664 must be installed before you can download and install KB3150513. |
+| Windows 8.1          | [KB 2976978](http://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB2976978)<br>Performs diagnostics on the Windows 8.1 systems that participate in the Windows Customer Experience Improvement Program. These diagnostics help determine whether compatibility issues may be encountered when the latest Windows operating system is installed. <br>For more information about this KB, see <https://support.microsoft.com/kb/2976978><br><BR>[KB 3150513](https://catalog.update.microsoft.com/v7/site/Search.aspx?q=3150513)<br>Provides updated configuration and definitions for compatibility diagnostics performed on the system.<br>For more information about this KB, see <https://support.microsoft.com/kb/3150513><br>NOTE: KB2976978 must be installed before you can download and install KB3150513.   |
+| Windows 7 SP1        | [KB2952664](http://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB2952664) <br>Performs diagnostics on the Windows 7 SP1 systems that participate in the Windows Customer Experience Improvement Program. These diagnostics help determine whether compatibility issues may be encountered when the latest Windows operating system is installed. <br>For more information about this KB, see <https://support.microsoft.com/kb/2952664><br><BR>[KB 3150513](https://catalog.update.microsoft.com/v7/site/Search.aspx?q=3150513)<br>Provides updated configuration and definitions for compatibility diagnostics performed on the system.<br>For more information about this KB, see <https://support.microsoft.com/kb/3150513><br>NOTE: KB2952664 must be installed before you can download and install KB3150513. |
 
 IMPORTANT: Restart user computers after you install the compatibility update KBs for the first time.
 
@@ -137,7 +137,7 @@ The Upgrade Analytics deployment script does the following:
 
 To run the Upgrade Analytics deployment script:
 
-1.  Download the [Upgrade Analytics deployment script](https://go.microsoft.com/fwlink/?LinkID=822966&clcid=0x409) and extract UpgradeAnalytics.zip. Inside, there are two folders: Pilot and Deployment. The Pilot folder contains advanced logging that can help troubleshoot issues and is inteded to be run from an elevated command prompt. The Deployment folder offers a lightweight script intended for broad deployment through ConfigMgr or other software deployment system. We recommend manually running the Pilot version of the script on 5-10 machines to verify that everything is configured correctly.  Once you have confirmed that data is flowing successfully, proceed to run the Deployment version throughout your organization.
+1.  Download the [Upgrade Analytics deployment script](https://go.microsoft.com/fwlink/?LinkID=822966&clcid=0x409) and extract UpgradeAnalytics.zip. Inside, there are two folders: Pilot and Deployment. The Pilot folder contains advanced logging that can help troubleshoot issues and is intended to be run from an elevated command prompt. The Deployment folder offers a lightweight script intended for broad deployment through ConfigMgr or other software deployment system. We recommend manually running the Pilot version of the script on 5-10 machines to verify that everything is configured correctly.  Once you have confirmed that data is flowing successfully, proceed to run the Deployment version throughout your organization.
 
 2.  Edit the following parameters in RunConfig.bat:
 
@@ -165,41 +165,45 @@ To run the Upgrade Analytics deployment script:
 
 4.  After you finish editing the parameters in RunConfig.bat, you are ready to run the script.  If you are using the Pilot version, run RunConfig.bat from an elevated command prompt. If you are using the Deployment version, use ConfigMgr or other software deployment service to run RunConfig.bat as system.
 
-The deployment script displays the following exit codes to let you know if it was successful, or if an error was encountered. 
+The deployment script displays the following exit codes to let you know if it was successful, or if an error was encountered.
 
 <div style='font-size:10.0pt'>
 
 <TABLE border=1 cellspacing=0 cellpadding=0>
-<TR><TH BGCOLOR="#a0e4fa">Exit code<TH BGCOLOR="#a0e4fa">Meaning
-<TR><TD>0<TD>Success
-<TR><TD>1<TD>Unexpected error occurred while executing the script
-<TR><TD>2<TD>Error when logging to console. $logMode = 0.
-<TR><TD>3<TD>Error when logging to console and file. $logMode = 1.
-<TR><TD>4<TD>Error when logging to file. $logMode = 2.
-<TR><TD>5<TD>Error when logging to console and file. $logMode = unknown.
-<TR><TD>6<TD>The commercialID parameter is set to unknown. Modify the script.
-<TR><TD>7<TD>Function -CheckCommercialId: Unexpected failure.
-<TR><TD>8<TD>Failure to create registry key path: HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection.
-<TR><TD>9<TD>Error when writing CommercialId to registry.
-<TR><TD>10<TD>Error when writing CommercialDataOptIn to registry.
-<TR><TD>11<TD>Function -SetupCommercialId: Unexpected failure.
-<TR><TD>12<TD>Can’t connect to Microsoft – Vortex. Check your network/proxy settings.
-<TR><TD>13<TD>Can’t connect to Microsoft – setting. Check your network/proxy settings.
-<TR><TD>14<TD>Can’t connect to Microsoft – compatexchange. Check your network/proxy settings.
-<TR><TD>15<TD>Error connecting to Microsoft. Check your network/proxy settings.
-<TR><TD>16<TD>Machine requires reboot.
-<TR><TD>17<TD>Function -CheckRebootRequired: Unexpected failure.
-<TR><TD>18<TD>Outdated compatibility update KB package. Update via Windows Update/WSUS.
-<TR><TD>19<TD>This machine doesn’t have the proper KBs installed. Make sure you have recent compatibility update KB downloaded.
-<TR><TD>20<TD>Error writing RequestAllAppraiserVersions registry key.
-<TR><TD>21<TD>Function – SetRequestAllAppraiserVersions: Unexpected failure.
-<TR><TD>22<TD>RunAppraiser failed with unexpected exception.
-<TR><TD>23<TD>Error finding system variable %WINDIR%.
-<TR><TD>24<TD>SetIEDataOptIn failed when writing IEDataOptIn to registry.
-<TR><TD>25<TD>SetIEDataOptIn failed with unexpected exception.
-<TR><TD>26<TD>The operating system is Server or LTSB SKU. The script does not support Server or LTSB SKUs.
-<TR><TD>27<TD>The script is not running under System account.  The Upgrade Analytics configuration script must be run as system.
-<TR><TD>28<TD>Could not create log file at the specified logPath.
+<TR><TH BGCOLOR="#a0e4fa">Exit code<TH BGCOLOR="#a0e4fa">Meaning<TH BGCOLOR="#a0e4fa">Suggested fix
+<TR><TD>0<TD>Success<TD>
+<TR><TD>1<TD>Unexpected error occurred while executing the script<TD> The files in the deployment script are likely corrupted.  Download the [latest script](https://go.microsoft.com/fwlink/?LinkID=822966&clcid=0x409) from the download center and try again.
+<TR><TD>2<TD>Error when logging to console. $logMode = 0.<TD> Try changing the $logMode value to **1** and try again.
+<TR><TD>3<TD>Error when logging to console and file. $logMode = 1.<TD>Verify that you have set the logPath parameter in RunConfig.bat, and that the configuration script has access to connect and write to this location.
+<TR><TD>4<TD>Error when logging to file. $logMode = 2.<TD>Verify that you have set the logPath parameter in RunConfig.bat, and that the configuration script has access to connect and write to this location.
+<TR><TD>5<TD>Error when logging to console and file. $logMode = unknown.<TD>Verify that you have set the logPath parameter in RunConfig.bat, and that the configuration script has access to connect and write to this location.
+<TR><TD>6<TD>The commercialID parameter is set to unknown. Modify the script.<TD>Set the value for CommercialID in runconfig.bat file.
+<TR><TD>8<TD>Failure to create registry key path: HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection. <TD> Verify that the configuration script has access to this location.
+<TR><TD>9<TD>Error when writing CommercialId to registry.<TD>Verify that the configuration script has access to this location.
+<TR><TD>10<TD>Error when writing CommercialDataOptIn to registry.<TD>Verify that the configuration script has access to this location.
+<TR><TD>11<TD>Function -SetupCommercialId: Unexpected failure.<TD>Verify that the configuration script has access to this location.
+<TR><TD>12<TD>Can’t connect to Microsoft – Vortex. Check your network/proxy settings.<TD>Verify that the required endpoints are whitelisted correctly.
+<TR><TD>13<TD>Can’t connect to Microsoft – setting. <TD>Verify that the required endpoints  are whitelisted correctly.
+<TR><TD>14<TD>Can’t connect to Microsoft – compatexchange.<TD> Verify that the required endpoints are whitelisted.
+<TR><TD>15<TD>Error connecting to Microsoft:Unexpected failure.<TD>
+<TR><TD>16<TD>Machine requires reboot.<TD> The reboot is required to complete the installation of the compatibility update and related KBs. Reboot the machine before running the Upgrade Analytics deployment script.
+<TR><TD>17<TD>Function -CheckRebootRequired: Unexpected failure.<TD>The reboot is required to complete the installation of the compatibility update and related KBs. Reboot the machine before running the Upgrade Analytics deployment script.
+<TR><TD>18<TD>Outdated compatibility update KB package. Update via Windows Update/WSUS.<TD>
+The configuration script detected a version of the Compatibility update module that is older than the minimum required to correctly collect the data required by Upgrade Analytics solution. Use the latest version of the Compatibility update for Windows 7 SP1/Windows 8.1.
+<TR><TD>19<TD>The compatibility update failed with unexpected exception.<TD> The files in the deployment script are likely corrupted.  Download the [latest script](https://go.microsoft.com/fwlink/?LinkID=822966&clcid=0x409) from the download center and try again.
+<TR><TD>20<TD>Error writing RequestAllAppraiserVersions registry key.<TD> This registry key is required for data collection to work correctly. Verify that the configuration script has access to this location.
+<TR><TD>21<TD>Function – SetRequestAllAppraiserVersions: Unexpected failure.<TD>This registry key is required for data collection to work correctly. Verify that the configuration script has access to this location.
+<TR><TD>22<TD>RunAppraiser failed with unexpected exception.<TD> Check %windir%\System32 directory for a file called CompatTelRunner.exe.  If the file does not exist, reinstall the required compatibility updates which include this file, and check your organization group policy to make sure it does not remove this file.
+<TR><TD>23<TD>Error finding system variable %WINDIR%.<TD> Make sure that this environment variable is available on the machine.
+<TR><TD>24<TD>SetIEDataOptIn failed when writing IEDataOptIn to registry.<TD> Verify that the deployment script in running in a context that has access to the registry key.
+<TR><TD>25<TD>SetIEDataOptIn failed with unexpected exception.<TD> The files in the deployment script are likely corrupted.  Download the latest script from the [download center](https://go.microsoft.com/fwlink/?LinkID=822966&clcid=0x409) and try again.
+<TR><TD>26<TD>The operating system is Server or LTSB SKU.<TD> The script does not support Server or LTSB SKUs.
+<TR><TD>27<TD>The script is not running under System account.<TD>The Upgrade Analytics configuration script must be run as system.  
+<TR><TD>28<TD>Could not create log file at the specified logPath.<TD> Make sure the deployment script has access to the location specified in the logPath parameter.
+<TR><TD>29<TD> Connectivity check failed for proxy authentication. <TD> Install the cumulative updates on the machine and enable the `DisableEnterpriseAuthProxy` authentication proxy setting. The `DisableEnterpriseAuthProxy` setting is enabled by default for Windows 7.  For Windows 8.1 machines, set the `DisableEnterpriseAuthProxy` setting to **0** (not disabled). For more information on authentication proxy support, see [this blog post](https://go.microsoft.com/fwlink/?linkid=838688).
+<TR><TD>30<TD>Connectivity check failed. Registry key property `DisableEnterpriseAuthProxy` is not enabled.<TD> The `DisableEnterpriseAuthProxy` setting is enabled by default for Windows 7.  For Windows 8.1 machines, set the `DisableEnterpriseAuthProxy` setting to **0** (not disabled). For more information on authentication proxy support, see [this blog post](https://go.microsoft.com/fwlink/?linkid=838688).
+<TR><TD>31<TD>There is more than one instance of the Upgrade Analytics data collector running at the same time on this machine. <TD>  Use the Windows Task Manager to check if CompatTelRunner.exe is running, and wait until it has completed to rerun the script.  
+**The Upgrade Analytics task is scheduled to run daily at 3 a.m.**
 </TABLE>
 
 </div>
@@ -207,4 +211,3 @@ The deployment script displays the following exit codes to let you know if it wa
 ## Seeing data from computers in Upgrade Analytics
 
 After data is sent from computers to Microsoft, it generally takes 48 hours for the data to populate in Upgrade Analytics. The compatibility update KB takes several minutes to run. If the KB does not get a chance to finish running or if the computers are inaccessible (turned off or sleeping for example), data will take longer to populate in Upgrade Analytics. For this reason, you can expect most your computers to be populated in OMS in about 1-2 weeks after deploying the KB and configuration to user computers.
-

windows/deploy/upgrade-analytics-requirements.md

@@ -1,4 +1,4 @@
----
+---
 title: Upgrade Analytics requirements (Windows 10)
 description: Provides requirements for Upgrade Analytics.
 ms.prod: w10
@@ -43,6 +43,8 @@ See [Windows 7, Windows 8, and Windows 8.1 appraiser telemetry events and fields
 
 `https://v10.vortex-win.data.microsoft.com/collect/v1`
 
+`https://vortex-win.data.microsoft.com/health/keepalive`
+
 `https://settings-win.data.microsoft.com/settings`
 
 `https://vortex.data.microsoft.com/health/keepalive`

windows/deploy/windows-10-poc-mdt.md

@@ -0,0 +1,634 @@
+---
+title: Step by step - Deploy Windows 10 in a test lab using MDT
+description: Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit (MDT)
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: deploy
+author: greg-lindsay
+---
+
+
+# Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit
+
+**Applies to**
+
+-   Windows 10
+
+**Important**: This guide leverages the proof of concept (PoC) environment configured using procedures in the following guide: 
+- [Step by step guide: Configure a test lab to deploy Windows 10](windows-10-poc.md)
+
+Please complete all steps in the prerequisite guide before starting this guide. This guide requires about 5 hours to complete, but can require less time or more time depending on the speed of the Hyper-V host. After completing the current guide, also see the companion guide:
+- [Deploy Windows 10 in a test lab using System Center Configuration Manager](windows-10-poc-sc-config-mgr.md)
+
+The PoC environment is a virtual network running on Hyper-V with three virtual machines (VMs):
+- **DC1**: A contoso.com domain controller, DNS server, and DHCP server.
+- **SRV1**: A dual-homed contoso.com domain member server, DNS server, and default gateway providing NAT service for the PoC network.
+- **PC1**: A contoso.com member computer running Windows 7, Windows 8, or Windows 8.1 that has been shadow-copied from a physical computer on your corporate network.
+
+>This guide uses the Hyper-V server role. If you do not complete all steps in a single session, consider using [checkpoints](https://technet.microsoft.com/library/dn818483.aspx) and [saved states](https://technet.microsoft.com/library/ee247418.aspx) to pause, resume, or restart your work.
+
+## In this guide
+
+This guide provides instructions to install and configure the Microsoft Deployment Toolkit (MDT) to deploy a Windows 10 image.
+
+Topics and procedures in this guide are summarized in the following table. An estimate of the time required to complete each procedure is also provided. Time required to complete procedures will vary depending on the resources available to the Hyper-V host and assigned to VMs, such as processor speed, memory allocation, disk speed, and network speed.
+
+<div style='font-size:9.0pt'>
+
+<TABLE border=1 cellspacing=0 cellpadding=0>
+<TR><TD BGCOLOR="#a0e4fa"><B>Topic</B><TD BGCOLOR="#a0e4fa"><B>Description</B><TD BGCOLOR="#a0e4fa"><B>Time</B>
+
+<TR><TD>[About MDT](#about-mdt)<TD>A high-level overview of the Microsoft Deployment Toolkit (MDT).<TD>Informational
+<TR><TD>[Install MDT](#install-mdt)<TD>Download and install MDT.<TD>40 minutes
+<TR><TD>[Create a deployment share and reference image](#create-a-deployment-share-and-reference-image)<TD>A reference image is created to serve as the template for deploying new images.<TD>90 minutes
+<TR><TD>[Deploy a Windows 10 image using MDT](#deploy-a-windows-10-image-using-mdt)<TD>The reference image is deployed in the PoC environment.<TD>60 minutes
+<TR><TD>[Refresh a computer with Windows 10](#refresh-a-computer-with-windows-10)<TD>Export user data from an existing client computer, wipe the computer, install a new operating system, and then restore user data and settings.<TD>60 minutes
+<TR><TD>[Replace a computer with Windows 10](#replace-a-computer-with-windows-10)<TD>Back up an existing client computer, then restore this backup to a new computer.<TD>60 minutes
+<TR><TD>[Troubleshooting logs, events, and utilities](#troubleshooting-logs-events-and-utilities)<TD>Log locations and troubleshooting hints.<TD>Informational
+</TABLE>
+
+</div>
+
+## About MDT
+
+MDT performs deployments by using the Lite Touch Installation (LTI), Zero Touch Installation (ZTI), and User-Driven Installation (UDI) deployment methods. 
+- LTI is the deployment method used in the current guide, requiring only MDT and performed with a minimum amount of user interaction.
+- ZTI is fully automated, requiring no user interaction and is performed using MDT and System Center Configuration Manager. After completing the steps in the current guide, see [Step by step: Deploy Windows 10 in a test lab using System Center Configuration Manager](windows-10-poc-sc-config-mgr.md) to use the ZTI deployment method in the PoC environment.
+- UDI requires manual intervention to respond to installation prompts such as machine name, password and language settings. UDI requires MDT and System Center Configuration Manager. 
+
+## Install MDT
+
+1. On SRV1, temporarily disable IE Enhanced Security Configuration for Administrators by typing the following commands at an elevated Windows PowerShell prompt:
+
+    ```
+    $AdminKey = "HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}"
+    Set-ItemProperty -Path $AdminKey -Name “IsInstalled” -Value 0
+    Stop-Process -Name Explorer
+    ```
+2. Download and install the 64-bit version of [Microsoft Deployment Toolkit (MDT)](https://www.microsoft.com/en-us/download/details.aspx?id=54259) on SRV1 using the default options. As of the writing of this guide, the latest version of MDT was 8443.
+
+3. Download and install the latest [Windows Assessment and Deployment Kit (ADK)](https://developer.microsoft.com/en-us/windows/hardware/windows-assessment-deployment-kit) on SRV1 using the default installation settings. The current version is the ADK for Windows 10, version 1607. Installation might require several minutes to acquire all components.
+
+3. If desired, re-enable IE Enhanced Security Configuration:
+
+    ```
+    Set-ItemProperty -Path $AdminKey -Name “IsInstalled” -Value 1
+    Stop-Process -Name Explorer
+    ```
+
+## Create a deployment share and reference image
+
+A reference image serves as the foundation for Windows 10 devices in your organization.
+
+1. In [Step by step guide: Configure a test lab to deploy Windows 10](windows-10-poc.md), the Windows 10 Enterprise .iso file was saved to the c:\VHD directory as **c:\VHD\w10-enterprise.iso**. The first step in creating a deployment share is to mount this file on SRV1.  To mount the Windows 10 Enterprise DVD on SRV1, open an elevated Windows PowerShell prompt on the Hyper-V host computer and type the following command:
+
+    ```
+    Set-VMDvdDrive -VMName SRV1 -Path c:\VHD\w10-enterprise.iso
+    ```
+2. On SRV1, verify that the Windows Enterprise installation DVD is mounted as drive letter D.
+
+3. The Windows 10 Enterprise installation files will be used to create a deployment share on SRV1 using the MDT deployment workbench. To open the deployment workbench, click **Start**, type **deployment**, and then click **Deployment Workbench**.
+
+4. To enable quick access to the application, right-click **Deployment Workbench** on the taskbar and then click **Pin this program to the taskbar**.
+
+5. In the Deployment Workbench console, right-click **Deployment Shares** and select **New Deployment Share**.
+
+6. Use the following settings for the New Deployment Share Wizard:
+    - Deployment share path: **C:\MDTBuildLab**<BR>
+    - Share name: **MDTBuildLab$**<BR>
+    - Deployment share description: **MDT build lab**<BR>
+    - Options: click **Next** to accept the default<BR>
+    - Summary: click **Next**<BR>
+    - Progress: settings will be applied<BR>
+    - Confirmation: click **Finish**
+
+
+7. Expand the **Deployment Shares** node, and then expand **MDT build lab**.
+
+8. Right-click the **Operating Systems** node, and then click **New Folder**. Name the new folder **Windows 10**. Complete the wizard using default values and click **Finish**.
+
+9. Right-click the **Windows 10** folder created in the previous step, and then click **Import Operating System**.
+
+10. Use the following settings for the Import Operating System Wizard: 
+    - OS Type: **Full set of source files**<BR>
+    - Source: **D:\\** <BR>
+    - Destination: **W10Ent_x64**<BR>
+    - Summary: click **Next**
+    - Progress: wait for files to be copied
+    - Confirmation: click **Finish**
+
+    >For purposes of this test lab, we will only add the prerequisite .NET Framework feature. Commerical applications (ex: Microsoft Office) will not be added to the deployment share. For information about adding applications, see the [Add applications](https://technet.microsoft.com/en-us/itpro/windows/deploy/create-a-windows-10-reference-image#sec03) section of the [Create a Windows 10 reference image](create-a-windows-10-reference-image.md) topic in the TechNet library.
+
+11. The next step is to create a task sequence to reference the operating system that was imported. To create a task sequence, right-click the **Task Sequences** node and then click **New Task Sequence**. Use the following settings for the New Task Sequence Wizard:
+    - Task sequence ID: **REFW10X64-001**<BR>
+    - Task sequence name: **Windows 10 Enterprise x64 Default Image** <BR>
+    - Task sequence comments: **Reference Build**<BR>
+    - Template: **Standard Client Task Sequence**
+    - Select OS: click **Windows 10 Enterprise Evaluation in W10Ent_x64 install.wim**
+    - Specify Product Key: **Do not specify a product key at this time**
+    - Full Name: **Contoso**
+    - Organization: **Contoso**
+    - Internet Explorer home page: **http://www.contoso.com**
+    - Admin Password: **Do not specify an Administrator password at this time**
+    - Summary: click **Next**
+    - Confirmation: click **Finish**
+
+
+12. Edit the task sequence to add the Microsoft NET Framework 3.5, which is required by many applications. To edit the task sequence, double-click **Windows 10 Enterprise x64 Default Image** that was created in the previous step.
+
+13. Click the **Task Sequence** tab. Under **State Restore** click **Tatto** to highlight it, then click **Add** and choose **New Group**.
+
+14. On the Properties tab of the group that was created in the previous step, change the Name from **New Group** to **Custom Tasks (Pre-Windows Update)** and then click **Apply**. Click another location in the window to see the name change.
+
+15. Click the **Custom Tasks (Pre-Windows Update)** group again, click **Add**, point to **Roles**, and then click **Install Roles and Features**.
+
+16. Under **Select the roles and features that should be installed**, select **.NET Framework 3.5 (includes .NET 2.0 and 3.0)** and then click **Apply**.
+
+17. Enable Windows Update in the task sequence by clicking the **Windows Update (Post-Application Installation)** step, clicking the **Options** tab, and clearing the **Disable this step** checkbox.
+    
+    >Note: Since we are not installing applications in this test lab, there is no need to enable the Windows Update Pre-Application Installation step. However, you should enable this step if you are also installing applications.
+
+18. Click **OK** to complete editing the task sequence.
+
+19. The next step is to configure the MDT deployment share rules. To configure rules in the Deployment Workbench, right-click **MDT build lab (C:\MDTBuildLab)** and click **Properties**, and then click the **Rules** tab.
+
+20. Replace the default rules with the following text:
+
+    ```
+    [Settings]
+    Priority=Default
+
+    [Default]
+    _SMSTSORGNAME=Contoso
+    UserDataLocation=NONE
+    DoCapture=YES
+    OSInstall=Y
+    AdminPassword=pass@word1
+    TimeZoneName=Pacific Standard Time
+    OSDComputername=#Left("PC-%SerialNumber%",7)#
+    JoinWorkgroup=WORKGROUP
+    HideShell=YES
+    FinishAction=SHUTDOWN
+    DoNotCreateExtraPartition=YES
+    ApplyGPOPack=NO
+    SkipAdminPassword=YES
+    SkipProductKey=YES
+    SkipComputerName=YES
+    SkipDomainMembership=YES
+    SkipUserData=YES
+    SkipLocaleSelection=YES
+    SkipTaskSequence=NO
+    SkipTimeZone=YES
+    SkipApplications=YES
+    SkipBitLocker=YES
+    SkipSummary=YES
+    SkipRoles=YES
+    SkipCapture=NO
+    SkipFinalSummary=NO
+    ```
+
+21. Click **Apply** and then click **Edit Bootstrap.ini**. Replace the contents of the Bootstrap.ini file with the following text, and save the file:
+
+    ```
+    [Settings]
+    Priority=Default
+
+    [Default]
+    DeployRoot=\\SRV1\MDTBuildLab$
+    UserDomain=CONTOSO
+    UserID=MDT_BA
+    UserPassword=pass@word1
+    SkipBDDWelcome=YES
+    ```
+
+22. Click **OK** to complete the configuration of the deployment share.
+
+23. Right-click **MDT build lab (C:\MDTBuildLab)** and then click **Update Deployment Share**.
+
+24. Accept all default values in the Update Deployment Share Wizard by clicking **Next** twice.  The update process will take 5 to 10 minutes. When it has completed, click **Finish**.
+
+25. Copy **c:\MDTBuildLab\Boot\LiteTouchPE_x86.iso** on SRV1 to the **c:\VHD** directory on the Hyper-V host computer. Note that in MDT, the x86 boot image can deploy both x86 and x64 operating systems, except on computers based on Unified Extensible Firmware Interface (UEFI).
+
+    >Hint: To copy the file, right-click the **LiteTouchPE_x86.iso** file and click **Copy** on SRV1, then open the **c:\VHD** folder on the Hyper-V host, right-click inside the folder and click **Paste**.
+
+26. Open a Windows PowerShell prompt on the Hyper-V host computer and type the following commands:
+
+    <div style='font-size:8.0pt'>
+    <pre style="overflow-y: visible">
+
+    New-VM REFW10X64-001 -SwitchName poc-internal -NewVHDPath "c:\VHD\REFW10X64-001.vhdx" -NewVHDSizeBytes 60GB
+    Set-VMMemory REFW10X64-001 -DynamicMemoryEnabled $true -MinimumBytes 1024MB -MaximumBytes 1024MB -Buffer 20
+    Set-VMDvdDrive REFW10X64-001 -Path c:\VHD\LiteTouchPE_x86.iso
+    Start-VM REFW10X64-001
+    vmconnect localhost REFW10X64-001
+	</pre>
+    </div>
+    
+    The VM will require a few minutes to prepare devices and boot from the LiteTouchPE_x86.iso file. 
+
+27. In the Windows Deployment Wizard, select **Windows 10 Enterprise x64 Default Image**, and then click **Next**.
+
+28. Accept the default values on the Capture Image page, and click **Next**. Operating system installation will complete after 5 to 10 minutes, and then the VM will reboot automatically. Allow the system to boot normally (do not press a key). The process is fully automated.
+
+	Additional system restarts will occur to complete updating and preparing the operating system. Setup will complete the following procedures:
+
+	- Install the Windows 10 Enterprise operating system.
+	- Install added applications, roles, and features.
+	- Update the operating system using Windows Update (or WSUS if optionally specified).
+	- Stage Windows PE on the local disk.
+	- Run System Preparation (Sysprep) and reboot into Windows PE.
+	- Capture the installation to a Windows Imaging (WIM) file.
+	- Turn off the virtual machine.<BR><BR>
+
+    This step requires from 30 minutes to 2 hours, depending on the speed of the Hyper-V host. After some time, you will have a Windows 10 Enterprise x64 image that is fully patched and has run through Sysprep. The image is located in the C:\MDTBuildLab\Captures folder on your deployment server (SRV1). The file name is **REFW10X64-001.wim**.
+
+## Deploy a Windows 10 image using MDT
+
+This procedure will demonstrate how to deploy the reference image to the PoC environment using MDT.
+
+1. On SRV1, open the MDT Deployment Workbench console, right-click **Deployment Shares**, and then click **New Deployment Share**. Use the following values in the New Deployment Share Wizard:
+     - **Deployment share path**: C:\MDTProd
+     - **Share name**: MDTProd$
+     - **Deployment share description**: MDT Production
+     - **Options**: accept the default
+
+
+2. Click **Next**, verify the new deployment share was added successfully, then click **Finish**.
+
+3. In the Deployment Workbench console, expand the MDT Production deployment share, right-click **Operating Systems**, and then click **New Folder**. Name the new folder **Windows 10** and complete the wizard using default values.
+
+4. Right-click the **Windows 10** folder created in the previous step, and then click **Import Operating System**.
+
+5. On the **OS Type** page, choose **Custom image file** and then click **Next**.
+
+6. On the Image page, browse to the **C:\MDTBuildLab\Captures\REFW10X64-001.wim** file created in the previous procedure, click **Open**, and then click **Next**.
+
+7. On the Setup page, select **Copy Windows 7, Windows Server 2008 R2, or later setup files from the specified path**. 
+
+8. Under **Setup source directory**, browse to **C:\MDTBuildLab\Operating Systems\W10Ent_x64** click **OK** and then click **Next**.
+
+9. On the Destination page, accept the default Destination directory name of **REFW10X64-001**, click **Next** twice, wait for the import process to complete, and then click **Finish**.
+
+10. In the **Operating Systems** > **Windows 10** node, double-click the operating system that was added to view its properties. Change the operating system name to **Windows 10 Enterprise x64 Custom Image** and then click **OK**. See the following example:
+
+    ![custom image](images/image.png)
+
+
+### Create the deployment task sequence
+
+1. Using the Deployment Workbench, right-click **Task Sequences** under the **MDT Production** node, click **New Folder** and create a folder with the name: **Windows 10**.
+
+2. Right-click the **Windows 10** folder created in the previous step, and then click **New Task Sequence**. Use the following settings for the New Task Sequence Wizard:
+    - Task sequence ID: W10-X64-001
+    - Task sequence name: Windows 10 Enterprise x64 Custom Image
+    - Task sequence comments: Production Image
+    - Select Template: Standard Client Task Sequence
+    - Select OS: Windows 10 Enterprise x64 Custom Image
+    - Specify Product Key: Do not specify a product key at this time
+    - Full Name: Contoso
+    - Organization: Contoso
+    - Internet Explorer home page: http://www.contoso.com
+    - Admin Password: pass@word1 
+    
+### Configure the MDT production deployment share
+
+1. On SRV1, open an elevated Windows PowerShell prompt and type the following commands:
+
+    ```
+    copy-item "C:\Program Files\Microsoft Deployment Toolkit\Templates\Bootstrap.ini" C:\MDTProd\Control\Bootstrap.ini -Force
+    copy-item "C:\Program Files\Microsoft Deployment Toolkit\Templates\CustomSettings.ini" C:\MDTProd\Control\CustomSettings.ini -Force
+    ``` 
+2. In the Deployment Workbench console on SRV1, right-click the **MDT Production** deployment share and then click **Properties**.
+
+3. Click the **Rules** tab and replace the rules with the following text (don't click OK yet):
+
+    ```
+    [Settings]
+    Priority=Default
+
+    [Default]
+    _SMSTSORGNAME=Contoso
+    OSInstall=YES
+    UserDataLocation=AUTO
+    TimeZoneName=Pacific Standard Time
+    OSDComputername=#Left("PC-%SerialNumber%",7)#
+    AdminPassword=pass@word1
+    JoinDomain=contoso.com
+    DomainAdmin=administrator
+    DomainAdminDomain=CONTOSO
+    DomainAdminPassword=pass@word1
+    ScanStateArgs=/ue:*\* /ui:CONTOSO\*
+    USMTMigFiles001=MigApp.xml
+    USMTMigFiles002=MigUser.xml
+    HideShell=YES
+    ApplyGPOPack=NO
+    SkipAppsOnUpgrade=NO
+    SkipAdminPassword=YES
+    SkipProductKey=YES
+    SkipComputerName=YES
+    SkipDomainMembership=YES
+    SkipUserData=YES
+    SkipLocaleSelection=YES
+    SkipTaskSequence=NO
+    SkipTimeZone=YES
+    SkipApplications=NO
+    SkipBitLocker=YES
+    SkipSummary=YES
+    SkipCapture=YES
+    SkipFinalSummary=NO
+    EventService=http://SRV1:9800
+    ```
+    **Note**: The contents of the Rules tab are added to c:\MDTProd\Control\CustomSettings.ini.
+    
+    >In this example a **MachineObjectOU** entry is not provided. Normally this entry describes the specific OU where new client computer objects are created in Active Directory. However, for the purposes of this test lab clients are added to the default computers OU, which requires that this parameter be unspecified.
+
+    If desired, edit the follow line to include or exclude other users when migrating settings. Currently, the command is set to user exclude (ue) all users except for CONTOSO users specified by the user include option (ui):
+    
+    ```
+    ScanStateArgs=/ue:*\* /ui:CONTOSO\*
+    ```
+
+    For example, to migrate **all** users on the computer, replace this line with the following:
+
+    ```
+    ScanStateArgs=/all
+    ```   
+
+    For more information, see [ScanState Syntax](https://technet.microsoft.com/library/cc749015.aspx).
+
+4. Click **Edit Bootstap.ini** and replace text in the file with the following text:
+
+    ```
+    [Settings]
+    Priority=Default
+
+    [Default]
+    DeployRoot=\\SRV1\MDTProd$
+    UserDomain=CONTOSO
+    UserID=MDT_BA
+    UserPassword=pass@word1
+    SkipBDDWelcome=YES
+    ```
+5. Click **OK** when finished. 
+
+### Update the deployment share
+
+1. Right-click the **MDT Production** deployment share and then click **Update Deployment Share**.
+
+2. Use the default options for the Update Deployment Share Wizard. The update process requires 5 to 10 minutes to complete.
+
+3. Click **Finish** when the update is complete.
+
+### Enable deployment monitoring
+
+1. In the Deployment Workbench console, right-click **MDT Production** and then click **Properties**.
+
+2. On the **Monitoring** tab, select the **Enable monitoring for this deployment share** checkbox, and then click **OK**.
+
+3. Verify the monitoring service is working as expected by opening the following link on SRV1 in Internet Explorer: [http://localhost:9800/MDTMonitorEvent/](http://localhost:9800/MDTMonitorEvent/). If you do not see "**You have created a service**" at the top of the page, see [Troubleshooting MDT 2012 Monitoring](https://blogs.technet.microsoft.com/mniehaus/2012/05/10/troubleshooting-mdt-2012-monitoring/).
+
+4. Close Internet Explorer.
+
+### Configure Windows Deployment Services
+
+1. Initialize Windows Deployment Services (WDS) by typing the following command at an elevated Windows PowerShell prompt on SRV1:
+
+    ```
+    WDSUTIL /Verbose /Progress /Initialize-Server /Server:SRV1 /RemInst:"C:\RemoteInstall"
+    WDSUTIL /Set-Server /AnswerClients:All
+    ```
+
+2. Click **Start**, type **Windows Deployment**, and then click **Windows Deployment Services**.
+
+3. In the Windows Deployment Services console, expand **Servers**, expand **SRV1.contoso.com**, right-click **Boot Images**, and then click **Add Boot Image**.
+
+4. Browse to the **C:\MDTProd\Boot\LiteTouchPE_x64.wim** file, click **Open**, click **Next**, and accept the defaults in the Add Image Wizard. Click **Finish** to complete adding a boot image.
+
+### Deploy the client image
+
+1. Before using WDS to deploy a client image, you must temporarily disable the external network adapter on SRV1. This is just an artifact of the lab environment. In a typical deployment environment WDS would not be installed on the default gateway. 
+
+    >**Note**: Do not disable the *internal* network interface. To quickly view IP addresses and interface names configured on the VM, type **Get-NetIPAddress | ft interfacealias, ipaddress**
+    
+    Assuming the external interface is named "Ethernet 2", to disable the *external* interface on SRV1, open a Windows PowerShell prompt on SRV1 and type the following command:
+
+    ```
+    Disable-NetAdapter "Ethernet 2" -Confirm:$false
+    ```
+
+2. Next, switch to the Hyper-V host and open an elevated Windows PowerShell prompt. Create a generation 2 VM on the Hyper-V host that will load its OS using PXE. To create this VM, type the following commands at an elevated Windows PowerShell prompt:
+
+    ```
+    New-VM –Name "PC2" –NewVHDPath "c:\vhd\pc2.vhdx" -NewVHDSizeBytes 60GB -SwitchName poc-internal -BootDevice NetworkAdapter -Generation 2
+    Set-VMMemory -VMName "PC2" -DynamicMemoryEnabled $true -MinimumBytes 720MB -MaximumBytes 2048MB -Buffer 20
+    ```
+    >Dynamic memory is configured on the VM to conserve resources. However, this can cause memory allocation to be reduced past what is required to install an operating system. If this happens, reset the VM and begin the OS installation task sequence immediately. This ensures the VM memory allocation is not decreased too much while it is idle.
+
+3. Start the new VM and connect to it:
+
+    ```
+    Start-VM PC2
+    vmconnect localhost PC2
+    ```
+4. When prompted, hit ENTER to start the network boot process.
+
+5. In the Windows Deployment Wizard, choose the **Windows 10 Enterprise x64 Custom Image** and then click **Next**.
+
+6. After MDT lite touch installation has started, be sure to re-enable the external network adapter on SRV1. This is needed so the client can use Windows Update after operating system installation is complete.To re-enable the external network interface, open an elevated Windows PowerShell prompt on SRV1 and type the following command:
+
+    ```
+    Enable-NetAdapter "Ethernet 2"
+    ```
+7. On SRV1, in the Deployment Workbench console, click on **Monitoring** and view the status of installation. Right-click **Monitoring** and click **Refresh** if no data is displayed.
+8. OS installation requires about 10 minutes. When the installation is complete, the system will reboot automatically, configure devices, and install updates, requiring another 10-20 minutes.  When the new client computer is finished updating, click **Finish**. You will be automatically signed in to the local computer as administrator.
+    
+    ![finish](images/deploy-finish.png)
+
+
+This completes the demonstration of how to deploy a reference image to the network. To conserve resources, turn off the PC2 VM before starting the next section.
+
+## Refresh a computer with Windows 10
+
+This section will demonstrate how to export user data from an existing client computer, wipe the computer, install a new operating system, and then restore user data and settings. The scenario will use PC1, a computer that was cloned from a physical device to a VM, as described in [Step by step guide: Deploy Windows 10 in a test lab](windows-10-poc.md). 
+
+If the PC1 VM is not already running, then start and connect to it:
+
+    ```
+    Start-VM PC1
+    vmconnect localhost PC1
+    ```
+
+1. Switch back to the Hyper-V host and create a checkpoint for the PC1 VM so that it can easily be reverted to its current state for troubleshooting purposes and to perform additional scenarios.  Checkpoints are also known as snapshots. To create a checkpoint for the PC1 VM, type the following command at an elevated Windows PowerShell prompt on the Hyper-V host:
+
+    ```
+    Checkpoint-VM -Name PC1 -SnapshotName BeginState
+    ```
+
+2. Sign on to PC1 using the CONTOSO\Administrator account.
+
+    >Specify **contoso\administrator** as the user name to ensure you do not sign on using the local administrator account. You must sign in with this account so that you have access to the deployment share.
+
+3. Open an elevated command prompt on PC1 and type the following:
+
+    ```
+    cscript \\SRV1\MDTProd$\Scripts\Litetouch.vbs
+    ```
+
+    **Note**: Litetouch.vbs must be able to create the C:\MININT directory on the local computer.
+
+4. Choose the **Windows 10 Enterprise x64 Custom Image** and then click **Next**.
+
+5. Choose **Do not back up the existing computer** and click **Next**.
+
+    **Note**: The USMT will still back up the computer.
+
+6. Lite Touch Installation will perform the following actions:
+    - Back up user settings and data using USMT.
+    - Install the Windows 10 Enterprise X64 operating system.
+    - Update the operating system via Windows Update.
+    - Restore user settings and data using USMT.
+
+    You can review the progress of installation on SRV1 by clicking on the **Monitoring** node in the deployment workbench. When OS installation is complete, the computer will restart, set up devices, and configure settings.
+
+7. Sign in with the CONTOSO\Administrator account and verify that all CONTOSO domain user accounts and data have been migrated to the new operating system, or other user accounts as specified [previously](#configure-the-mdt-production-deployment-share).
+
+8. Create another checkpoint for the PC1 VM so that you can review results of the computer refresh later. To create a checkpoint, type the following command at an elevated Windows PowerShell prompt on the Hyper-V host:
+
+    ```
+    Checkpoint-VM -Name PC1 -SnapshotName RefreshState
+    ```
+
+9. Restore the PC1 VM to it's previous state in preparation for the replace procedure. To restore a checkpoint, type the following command at an elevated Windows PowerShell prompt on the Hyper-V host:
+
+    ```
+    Restore-VMSnapshot -VMName PC1 -Name BeginState -Confirm:$false
+    Start-VM PC1
+    vmconnect localhost PC1
+    ```
+    
+10. Sign in to PC1 using the contoso\administrator account.
+
+## Replace a computer with Windows 10
+
+At a high level, the computer replace process consists of:<BR>
+- A special replace task sequence that runs the USMT backup and an optional full Window Imaging (WIM) backup.<BR>
+- A standard OS deployment on a new computer. At the end of the deployment, the USMT backup from the old computer is restored.
+
+### Create a backup-only task sequence
+
+1. On SRV1, in the deployment workbench console, right-click the MDT Production deployment share, click **Properties**, click the **Rules** tab, and change the line **SkipUserData=YES** to **SkipUserData=NO**.
+2. Click **OK**, right-click **MDT Production**, click **Update Deployment Share** and accept the default options in the wizard to update the share.
+3. Type the following commands at an elevated Windows PowerShell prompt on SRV1:
+
+    ```
+    New-Item -Path C:\MigData -ItemType directory
+    New-SmbShare -Name MigData$ -Path C:\MigData -ChangeAccess EVERYONE
+    icacls C:\MigData /grant '"contoso\administrator":(OI)(CI)(M)'
+    ```
+4. On SRV1 in the deployment workbench, under **MDT Production**, right-click the **Task Sequences** node, and click **New Folder**.
+5. Name the new folder **Other**, and complete the wizard using default options.
+6. Right-click the **Other** folder and then click **New Task Sequence**. Use the following values in the wizard:
+    - **Task sequence ID**: REPLACE-001
+    - **Task sequence name**: Backup Only Task Sequence
+    - **Task sequence comments**: Run USMT to back up user data and settings
+    - **Template**: Standard Client Replace Task Sequence (note: this is not the default template)
+7. Accept defaults for the rest of the wizard and then click **Finish**. The replace task sequence will skip OS selection and settings.
+8. Open the new task sequence that was created and review it. Note the type of capture and backup tasks that are present. Click **OK** when you are finished reviewing the task sequence.
+
+### Run the backup-only task sequence
+
+1. If you are not already signed on to PC1 as **contoso\administrator**, sign in using this account. To verify the currently signed in account, type the following command at an elevated command prompt:
+
+    ```
+    whoami
+    ```
+2. To ensure a clean environment before running the backup task sequence, type the following at an elevated Windows PowerShell prompt on PC1:
+
+    ```
+    Remove-Item c:\minint -recurse
+    Remove-Item c:\_SMSTaskSequence -recurse
+    Restart-Computer
+    ```
+2. Sign in to PC1 using the contoso\administrator account, and then type the following at an elevated command prompt:
+
+    ```
+    cscript \\SRV1\MDTProd$\Scripts\Litetouch.vbs
+    ```
+3. Complete the deployment wizard using the following:
+    - **Task Sequence**: Backup Only Task Sequence
+    - **User Data**: Specify a location: **\\SRV1\MigData$\PC1**
+    - **Computer Backup**: Do not back up the existing computer.
+4. While the task sequence is running on PC1, open the deployment workbench console on SRV1 and click the **Monitoring* node. Press F5 to refresh the console, and view the status of current tasks.  
+5. Verify that **The user state capture was completed successfully** is displayed, and click **Finish** when the capture is complete.
+6. On SRV1, verify that the file **USMT.MIG** was created in the **C:\MigData\PC1\USMT** directory. See the following example:
+
+    ```
+    PS C:\> dir C:\MigData\PC1\USMT
+
+        Directory: C:\MigData\PC1\USMT
+
+    Mode                LastWriteTime     Length Name
+    ----                -------------     ------ ----
+    -a---          9/6/2016  11:34 AM   14248685 USMT.MIG
+    ```
+### Deploy PC3 
+
+1. On the Hyper-V host, type the following commands at an elevated Windows PowerShell prompt:
+
+    ```
+    New-VM –Name "PC3" –NewVHDPath "c:\vhd\pc3.vhdx" -NewVHDSizeBytes 60GB -SwitchName poc-internal -BootDevice NetworkAdapter -Generation 2
+    Set-VMMemory -VMName "PC3" -DynamicMemoryEnabled $true -MinimumBytes 512MB -MaximumBytes 2048MB -Buffer 20
+    ```
+2. Temporarily disable the external network adapter on SRV1 again, so that we can successfully boot PC3 from WDS. To disable the adapter, type the following command at an elevated Windows PowerShell prompt on SRV1:
+
+    ```
+    Disable-NetAdapter "Ethernet 2" -Confirm:$false
+    ```
+3. Start and connect to PC3 by typing the following commands at an elevated Windows PowerShell prompt on the Hyper-V host:
+
+    ```
+    Start-VM PC3
+    vmconnect localhost PC3
+    ```
+4. When prompted, press ENTER for network boot.
+
+6. On PC3, ue the following settings for the Windows Deployment Wizard:
+    - **Task Sequence**: Windows 10 Enterprise x64 Custom Image
+    - **Move Data and Settings**: Do not move user data and settings
+    - **User Data (Restore)**: Specify a location: **\\SRV1\MigData$\PC1**
+5. When OS installation has started on PC1, re-enable the external network adapter on SRV1 by typing the following command on SRV1:
+
+    ```
+    Enable-NetAdapter "Ethernet 2"
+    ```
+7. Setup will install the Windows 10 Enterprise operating system, update via Windows Update, and restore the user settings and data from PC1.
+
+8. When PC3 has completed installing the OS, sign in to PC3 using the contoso\administrator account. When the PC completes updating, click **Finish**.
+
+9. Verify that settings have been migrated from PC1, and then shut down PC3 in preparation for the next procedure.
+
+## Troubleshooting logs, events, and utilities
+
+Deployment logs are available on the client computer in the following locations:
+- Before the image is applied: X:\MININT\SMSOSD\OSDLOGS
+- After the system drive has been formatted: C:\MININT\SMSOSD\OSDLOGS
+- After deployment: %WINDIR%\TEMP\DeploymentLogs
+
+You can review WDS events in Event Viewer at: **Applications and Services Logs > Microsoft > Windows > Deployment-Services-Diagnostics**. By default, only the **Admin** and **Operational** logs are enabled. To enable other logs, right-click the log and then click **Enable Log**.
+
+Tools for viewing log files, and to assist with troubleshooting are available in the [System Center 2012 R2 Configuration Manager Toolkit](https://www.microsoft.com/en-us/download/details.aspx?id=50012)
+
+Also see [Resolve Windows 10 upgrade errors](resolve-windows-10-upgrade-errors.md) for detailed troubleshooting information.
+
+## Related Topics
+
+[Microsoft Deployment Toolkit](https://technet.microsoft.com/en-US/windows/dn475741)<BR>
+[Prepare for deployment with MDT 2013](prepare-for-windows-deployment-with-mdt-2013.md)
+
+ 
+
+
+
+
+

windows/keep-secure/TOC.md

@@ -38,6 +38,10 @@
 ### [General guidance and best practices for Windows Information Protection (WIP)](guidance-and-best-practices-wip.md)
 #### [Enlightened apps for use with Windows Information Protection (WIP)](enlightened-microsoft-apps-and-wip.md)
 #### [Unenlightened and enlightened app behavior while using Windows Information Protection (WIP)](app-behavior-with-wip.md)
+#### [Recommended Enterprise Cloud Resources and Neutral Resources network settings with Windows Information Protection (WIP)](recommended-network-definitions-for-wip.md)
+#### [Using Outlook Web Access with Windows Information Protection (WIP)](using-owa-with-wip.md)
+## [Use Windows Event Forwarding to help with intrusion detection](use-windows-event-forwarding-to-assist-in-instrusion-detection.md)
+## [Override Process Mitigation Options to help enforce app-related security policies](override-mitigation-options-for-app-related-security-policies.md)
 ## [VPN technical guide](vpn-guide.md)
 ### [VPN connection types](vpn-connection-type.md)
 ### [VPN routing decisions](vpn-routing.md)
@@ -693,16 +697,16 @@
 ##### [Smart Cards Debugging Information](smart-card-debugging-information.md)
 ##### [Smart Card Group Policy and Registry Settings](smart-card-group-policy-and-registry-settings.md)
 ##### [Smart Card Events](smart-card-events.md)
-### [Trusted Platform Module](trusted-platform-module-overview.md)
+### [Trusted Platform Module](trusted-platform-module-top-node.md)
+#### [Trusted Platform Module Overview](trusted-platform-module-overview.md)
 #### [TPM fundamentals](tpm-fundamentals.md)
 #### [TPM Group Policy settings](trusted-platform-module-services-group-policy-settings.md)
-#### [AD DS schema extensions to support TPM backup](ad-ds-schema-extensions-to-support-tpm-backup.md)
-#### [Backup the TPM recovery Information to AD DS](backup-tpm-recovery-information-to-ad-ds.md)
+#### [Back up the TPM recovery information to AD DS](backup-tpm-recovery-information-to-ad-ds.md)
 #### [Manage TPM commands](manage-tpm-commands.md)
 #### [Manage TPM lockout](manage-tpm-lockout.md)
 #### [Change the TPM owner password](change-the-tpm-owner-password.md)
-#### [Initialize and configure ownership of the TPM](initialize-and-configure-ownership-of-the-tpm.md)
-#### [Switch PCR banks on TPM 2.0 devices](switch-pcr-banks-on-tpm-2-0-devices.md)
+#### [View status, clear, or troubleshoot the TPM](initialize-and-configure-ownership-of-the-tpm.md)
+#### [Understanding PCR banks on TPM 2.0 devices](switch-pcr-banks-on-tpm-2-0-devices.md)
 #### [TPM recommendations](tpm-recommendations.md)
 ### [User Account Control](user-account-control-overview.md)
 #### [How User Account Control works](how-user-account-control-works.md)
@@ -871,4 +875,6 @@
 ### [Control the health of Windows 10-based devices](protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md)
 ### [Windows 10 Mobile security guide](windows-10-mobile-security-guide.md)
 ### [Windows 10 security overview](windows-10-security-guide.md)
+### [Windows 10 credential theft mitigation guide abstract](windows-credential-theft-mitigation-guide-abstract.md)
+### [How to use single sign-on (SSO) over VPN and Wi-Fi connections](how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md)
 ## [Change history for Keep Windows 10 secure](change-history-for-keep-windows-10-secure.md)

windows/keep-secure/ad-ds-schema-extensions-to-support-tpm-backup.md

@@ -1,289 +1,5 @@
 ---
-title: AD DS schema extensions to support TPM backup (Windows 10)
-description: This topic provides more details about this change and provides template schema extensions that you can incorporate into your organization.
-ms.assetid: beb7097c-e674-4eab-b8e2-6f67c85d1f3f
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.sitesec: library
-ms.pagetype: security
-author: brianlic-msft
+title: AD DS schema extensions to support TPM backup
+redirect_url: https://technet.microsoft.com/library/jj635854.aspx
 ---
 
-# AD DS schema extensions to support TPM backup
-
-**Applies to**
--   Windows 10, version 1511
--   Windows 10, version 1507
-
-**Does not apply to**
-- Windows 10, version 1607 or later
-
-This topic provides more details about this change and provides template schema extensions that you can incorporate into your organization.
-
-## Why a schema extension is needed
-
-The TPM owner authorization value is now stored in a separate object which is linked to the Computer object. This value was stored as a property in the Computer object itself for the default Windows Server 2008 R2 schema. Windows Server 2012 domain controllers have the default schema to backup TPM owner authorization information in the separate object. If you are not upgrading your domain controller to Windows Server 2012, you need to extend the schema to support this change. If Active Directory backup of the TPM owner authorization value is enabled in a Windows Server 2008 R2 environment without extending the schema, the TPM provisioning will fail and the TPM will remain in a Not Ready state for computers running Windows 8. The following are the two schema extensions that you can use to bring your Windows Server 2008 R2 domain to parity with Windows Server 2012:
-
-### <a href="" id="tpmschemaextension-ldf-"></a>TpmSchemaExtension.ldf
-
-This schema extension brings parity with the Windows Server 2012 schema and is required if you want to store the TPM owner authorization value for a computer running Windows 8 in a Windows Server 2008 R2 AD DS domain. With this extension the TPM owner authorization information will be stored in a separate TPM object linked to the corresponding computer object.
-
-``` syntax
-#===============================================================================
-#
-# Active Directory Domain Services schema extension for 
-# BitLocker Drive Encryption and Trusted Platform Module (TPM) recovery
-#
-# This file contains attributes and class objects that enable Windows Server
-# 2008 and Windows Server 2008 R2 domain controllers to store TPM recovery
-# information in a new, TPM-specific location.
-#
-# Change History: 
-#   07/2010 - Created
-#
-# To extend the schema, use the LDIFDE tool on the schema master of the forest.
-#
-# Sample command:
-#   ldifde -i -v -f TPMSchemaExtension.ldf -c "DC=X" "DC=nttest,dc=microsoft,dc=com" -k -j .
-#
-# For more information on LDIFDE tool, see
-# http://support.microsoft.com/default.aspx?scid=kb;en-us;237677 
-#
-#===============================================================================
-#===============================================================================
-# New schema attributes
-#===============================================================================
-#
-# ms-TPM-Srk-Pub-Thumbprint
-# GUID: 19d706eb-4d76-44a2-85d6-1c342be3be37
-#
-dn: CN=ms-TPM-Srk-Pub-Thumbprint,CN=Schema,CN=Configuration,DC=X
-changetype: add
-objectClass: attributeSchema
-ldapDisplayName: msTPM-SrkPubThumbprint
-adminDisplayName: TPM-SrkPubThumbprint
-adminDescription: This attribute contains the thumbprint of the SrkPub corresponding to a particular TPM. This helps to index the TPM devices in the directory.
-attributeId: 1.2.840.113556.1.4.2107
-attributeSyntax: 2.5.5.10
-omSyntax: 4
-isSingleValued: TRUE
-searchFlags: 11
-schemaIdGuid:: 6wbXGXZNokSF1hw0K+O+Nw==
-showInAdvancedViewOnly: TRUE
-isMemberOfPartialAttributeSet: FALSE
-rangeUpper: 20
-#
-# ms-TPM-Owner-Information-Temp
-# GUID: c894809d-b513-4ff8-8811-f4f43f5ac7bc
-#
-dn: CN=ms-TPM-Owner-Information-Temp,CN=Schema,CN=Configuration,DC=X
-changetype: add
-objectClass: attributeSchema
-ldapDisplayName: msTPM-OwnerInformationTemp
-adminDisplayName: TPM-OwnerInformationTemp
-adminDescription: This attribute contains temporary owner information for a particular TPM.
-attributeId: 1.2.840.113556.1.4.2108
-attributeSyntax: 2.5.5.12
-omSyntax: 64
-isSingleValued: TRUE
-searchFlags: 640
-rangeUpper: 128
-schemaIdGuid:: nYCUyBO1+E+IEfT0P1rHvA==
-showInAdvancedViewOnly: TRUE
-isMemberOfPartialAttributeSet: FALSE
-#
-# ms-TPM-Tpm-Information-For-Computer
-# GUID: ea1b7b93-5e48-46d5-bc6c-4df4fda78a35
-#
-dn: CN=ms-TPM-Tpm-Information-For-Computer,CN=Schema,CN=Configuration,DC=X
-changetype: add
-objectClass: attributeSchema
-ldapDisplayName: msTPM-TpmInformationForComputer
-adminDisplayName: TPM-TpmInformationForComputer
-adminDescription: This attribute links a Computer object to a TPM object.
-attributeId: 1.2.840.113556.1.4.2109
-attributeSyntax: 2.5.5.1
-omSyntax: 127
-isSingleValued: TRUE
-searchFlags: 16
-omObjectClass:: KwwCh3McAIVK
-schemaIdGuid:: k3sb6khe1Ua8bE30/aeKNQ==
-showInAdvancedViewOnly: TRUE
-isMemberOfPartialAttributeSet: FALSE
-linkId: 2182
-#
-# ms-TPM-TpmInformation-For-Computer-BL
-# GUID: 14fa84c9-8ecd-4348-bc91-6d3ced472ab7
-#
-dn: CN=ms-TPM-Tpm-Information-For-Computer-BL,CN=Schema,CN=Configuration,DC=X
-changetype: add
-objectClass: attributeSchema
-ldapDisplayName: msTPM-TpmInformationForComputerBL
-adminDisplayName: TPM-TpmInformationForComputerBL
-adminDescription: This attribute links a TPM object to the Computer objects associated with it.
-attributeId: 1.2.840.113556.1.4.2110
-attributeSyntax: 2.5.5.1
-omSyntax: 127
-isSingleValued: FALSE
-searchFlags: 0
-omObjectClass:: KwwCh3McAIVK
-schemaIdGuid:: yYT6FM2OSEO8kW087Ucqtw==
-showInAdvancedViewOnly: TRUE
-systemOnly: TRUE
-linkId: 2183
-#
-# Commit the new attributes
-#
-dn:
-changetype: modify
-add: schemaUpdateNow
-schemaUpdateNow: 1
--
-#
-# Modify the Computer schema to support the TPM link
-#
-dn: CN=computer,CN=Schema,CN=Configuration,DC=X
-changetype: modify
-add: mayContain
-mayContain: msTPM-TpmInformationForComputer
--
-#
-# Commit the modification to the computer class
-#
-dn:
-changetype: modify
-add: schemaUpdateNow
-schemaUpdateNow: 1
--
-#===============================================================================
-# New schema classes
-#===============================================================================
-#
-# ms-TPM-Information-Objects-Container
-# GUID: e027a8bd-6456-45de-90a3-38593877ee74
-#
-dn: CN=ms-TPM-Information-Objects-Container,CN=Schema,CN=Configuration,DC=X
-changetype: add
-objectClass: classSchema
-ldapDisplayName: msTPM-InformationObjectsContainer
-adminDisplayName: TPM-InformationObjectsContainer
-adminDescription: Container for TPM objects.
-governsID: 1.2.840.113556.1.5.276
-objectClassCategory: 1
-subClassOf: top
-systemMustContain: cn
-systemPossSuperiors: domain
-systemPossSuperiors: domainDNS
-schemaIdGUID:: vagn4FZk3kWQozhZOHfudA==
-defaultSecurityDescriptor: D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;LOLCCCRP;;;DC)
-defaultHidingValue: TRUE
-defaultObjectCategory: CN=ms-TPM-Information-Objects-Container,CN=Schema,CN=Configuration,DC=X
-#
-# ms-TPM-Information-Object
-# GUID: 85045b6a-47a6-4243-a7cc-6890701f662c
-#
-# NOTE: If the 'defaultSecurityDescriptor' value below is changed,
-#   also change the other '.ldf' files in this directory, as appropriate.
-#
-dn: CN=ms-TPM-Information-Object,CN=Schema,CN=Configuration,DC=X
-changetype: add
-objectClass: classSchema
-ldapDisplayName: msTPM-InformationObject
-adminDisplayName: TPM-InformationObject
-adminDescription: This class contains recovery information for a Trusted Platform Module (TPM) device.
-governsID: 1.2.840.113556.1.5.275
-objectClassCategory: 1
-subClassOf: top
-systemMustContain: msTPM-OwnerInformation
-systemMayContain: msTPM-SrkPubThumbprint
-systemMayContain: msTPM-OwnerInformationTemp
-systemPossSuperiors: 1.2.840.113556.1.5.276
-schemaIdGUID:: alsEhaZHQ0KnzGiQcB9mLA==
-defaultSecurityDescriptor: D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;RPLO;;;DC)(A;;WP;;;CO)
-defaultHidingValue: TRUE
-defaultObjectCategory: CN=ms-TPM-Information-Object,CN=Schema,CN=Configuration,DC=X
-#
-# NOTE: If the 'defaultSecurityDescriptor' value above is changed,
-#   also change the other '.ldf' files in this directory, as appropriate.
-#
-#
-# Commit the new TPM object class
-#
-dn:
-changetype: modify
-add: schemaUpdateNow
-schemaUpdateNow: 1
--
-#===============================================================================
-# New objects
-#===============================================================================
-#
-# Add the TPM container to its location in the directory
-#
-dn: CN=TPM Devices,DC=X
-changetype: add
-objectClass: msTPM-InformationObjectsContainer
-```
-
-You should be aware that only the Computer object that has created the TPM object can update it. This means that any subsequent updates to the TPM objects will not succeed in dual boot scenarios or scenarios where the computer is reimaged resulting in a new AD computer object being created. If you are planning to support such scenarios, you will need to update the schema further as shown in the schema extension example, TpmSchemaExtensionACLChanges.ldf.
-
-### TpmSchemaExtensionACLChanges.ldf
-
-This schema update modifies the ACLs on the TPM object to be less restrictive so that any subsequent operating system which takes ownership of the computer object can update the owner authorization value in AD DS.
-> **Important**  After implementing this schema update, any computer in the domain can update the OwnerAuth of the TPM object (although it cannot read the OwnerAuth). When using this extension, perform a regular backup of the TPM objects and enable auditing to track the changes for these objects.
- 
-``` syntax
-#===============================================================================
-#
-# Active Directory Domain Services schema extension for 
-# BitLocker Drive Encryption and Trusted Platform Module (TPM) recovery
-#
-# This file modifies a class object that enables Windows Server 2008
-# and Windows Server 2008 R2 domain controllers to store TPM recovery
-# information in a new, TPM-specific location.
-#
-# This file converts the standard schema extension in which only the creator
-# of an 'ms-TPM-Information-Object' can write to the object to the Open
-# schema extension in which any Domain Computer can write to the object.
-#
-# This conversion does not apply to any 'ms-TPM-Information-Object' that
-# was created before the conversion.
-#
-# Change History: 
-#   12/2011 - Created
-#
-# To change the schema, use the LDIFDE tool on the schema master of the forest.
-#
-# Sample command:
-#   ldifde -i -v -f TpmSchemaExtensionACLChanges.ldf
-#      -c "DC=X" "DC=nttest,dc=microsoft,dc=com" -k -j .
-#
-# For more information on LDIFDE tool, see
-# http://support.microsoft.com/default.aspx?scid=kb;en-us;237677 
-#
-#===============================================================================
-#
-# Modify the TPM-Information-Object class schema 'defaultSecurityDescriptor' to
-# allow any Domain Computer to write its properties (including the TPM OwnerAuth
-# value) from allowing only the creating Computer object to write its properties
-#
-# NOTE: Keep any changes to the 'defaultSecurityDescriptor' value in synchronization
-#   with the value in the TPM-Information-Object class description in the
-#   'TpmSchemaExtension.ldf' file
-#
-dn: CN=ms-TPM-Information-Object,CN=Schema,CN=Configuration,DC=X
-changetype: modify
-replace: defaultSecurityDescriptor
-defaultSecurityDescriptor: D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;RPWPLO;;;DC)
--
-#
-# Commit the modification to the TPM-Information-Object schema
-#
-dn:
-changetype: modify
-add: schemaUpdateNow
-schemaUpdateNow: 1
--
-```
- 
- 

windows/keep-secure/backup-tpm-recovery-information-to-ad-ds.md

@@ -1,6 +1,6 @@
 ---
-title: Backup the TPM recovery Information to AD DS (Windows 10)
-description: This topic for the IT professional describes how to back up a computer’s Trusted Platform Module (TPM) information to Active Directory Domain Services (AD DS) so that you can use AD DS to administer the TPM from a remote computer.
+title: Back up the TPM recovery information to AD DS (Windows 10)
+description: This topic for the IT professional describes backup of Trusted Platform Module (TPM) information.
 ms.assetid: 62bcec80-96a1-464e-8b3f-d177a7565ac5
 ms.prod: w10
 ms.mktglfcycl: deploy
@@ -9,556 +9,19 @@ ms.pagetype: security
 author: brianlic-msft
 ---
 
-# Backup the TPM recovery Information to AD DS
+# Back up the TPM recovery information to AD DS
 
 **Applies to**
 -   Windows 10, version 1511
 -   Windows 10, version 1507
 
 **Does not apply to**
-- Windows 10, version 1607 or later
 
-This topic for the IT professional describes how to back up a computer’s Trusted Platform Module (TPM) information to Active Directory Domain Services (AD DS) so that you can use AD DS to administer the TPM from a remote computer.
+-   Windows 10, version 1607 or later
 
-## About administering TPM remotely
+With Windows 10, versions 1511 and 1507, you can back up a computer’s Trusted Platform Module (TPM) information to Active Directory Domain Services (AD DS). By doing this, you can use AD DS to administer the TPM from a remote computer. The procedure is the same as it was for Windows 8.1. For more information, see [Backup the TPM Recovery Information to AD DS](https://technet.microsoft.com/library/dn466534(v=ws.11).aspx).
 
-Backing up the TPM owner information for a computer allows administrators in a domain to remotely configure the TPM security hardware on the local computer. For example, administrators might want to reset the TPM to the manufacturer’s defaults when they decommission or repurpose computers, without having to be present at the computer.
+## Related topics
 
-You can use AD DS to store TPM owner information for use in recovery situations where the TPM owner has forgotten the password or where you must take control of the TPM. There is only one TPM owner password per computer; therefore, the hash of the TPM owner password can be stored as an attribute of the computer object in AD DS. The attribute has the common name (CN) of **ms-TPM-OwnerInformation**.
-
-> **Note:**  The TPM owner authorization value is stored in AD DS, and it is present in a TPM owner password file as a SHA-1 hash of the TPM owner password, which is base 64–encoded. The actual owner password is not stored.
- 
-Domain controllers running Windows Server 2012 R2 or Windows Server 2012 include the required AD DS schema objects by default. However, if your domain controller is running Windows Server 2008 R2, you need to update the schema as described in [AD DS schema extensions to support TPM backup](ad-ds-schema-extensions-to-support-tpm-backup.md).
-
-This topic contains procedures, some of which are dependent on Visual Basic scripts, to recover TPM information and decommission TPM on remote computers. Sample scripts are available, which you can customize to meet the requirements of your environment.
-
-In this topic:
-
-1.  [Check status of prerequisites](#bkmk-prereqs)
-2.  [Set permissions to back up password information](#bkmk-setperms)
-3.  [Configure Group Policy to back up TPM recovery information in AD DS](#bkmk-configuregp)
-4.  [Use AD DS to recover TPM information](#bkmk-useit)
-5.  [Sample scripts](#bkmk-adds-tpm-scripts)
-
-## <a href="" id="bkmk-prereqs"></a>Check status of prerequisites
-
-Before you begin your backup, ensure that the following prerequisites are met:
-
-1.  All domain controllers that are accessible by client computers that will be using TPM services are running Windows Server 2012 R2, Windows Server 2012, or Windows Server 2008 R2 with the updated schema.
-    
-    > **Tip:**  For more info about the schema extensions that are required for a TPM backup in Active Directory domains that are running Windows Server 2008 R2, see [AD DS schema extensions to support TPM backup](ad-ds-schema-extensions-to-support-tpm-backup.md).
-     
-2.  You have domain administrator rights in the target forest, or you are using an account that has been granted appropriate permissions to extend the schema for the target forest. Members of the Enterprise Admins or Schema Admins groups are examples of accounts that have the appropriate permissions.
-
-## <a href="" id="bkmk-setperms"></a>Set permissions to back up password information
-
-This procedure uses the sample script [Add-TPMSelfWriteACE.vbs](#bkmk-add-tpmselfwriteace) to add an access control entry (ACE) so that backing up TPM recovery information is possible. A client computer cannot back up TPM owner information until this ACE is added.
-
-This script is run on the domain controller that you will use to administer the TPM recovery information, and it operates under the following assumptions:
-
--   You have domain administrator credentials to set permissions for the top-level domain object.
--   Your target domain is the same as the domain for the user account that is running the script. For example, running the script as TESTDOMAIN\\admin will extend permissions for TESTDOMAIN.
-
-    > **Note:**  You might need to modify the sample script if you want to set permissions for multiple domains, but you do not have domain administrator accounts for each of those domains. Find the variable **strPathToDomain** in the script, and modify it for your target domain, for example:
-    `LDAP://DC=testdomain,DC=nttest,DC=microsoft,DC=com`
-     
--   Your domain is configured so that permissions are inherited from the top-level domain object to targeted computer objects.
-
-    Permissions will not take effect if any container in the hierarchy does not allow inherited permissions. By default, permissions inheritance is set in AD DS. If you are not sure whether your configuration differs from this default, you can continue with the setup steps to set the permissions. 
-    You can then verify your configuration as described later in this topic. Or you can click the **Effective Permissions** button while viewing the properties of a computer object, then check that **Self** is approved to write the **msTPM-OwnerInformation** attribute.
-
-**To add an ACE to allow TPM recovery information backup**
-
-1.  Open the sample script **Add-TPMSelfWriteACE.vbs**.
-
-    The script contains a permission extension, and you must modify the value of **strPathToDomain** by using your domain name.
-
-2.  Save your modifications to the script.
-3.  Type the following at a command prompt, and then press ENTER:
-
-    **cscript Add-TPMSelfWriteACE.vbs**
-
-This script adds a single ACE to the top-level domain object. The ACE is an inheritable permission that allows the computer (SELF) to write to the **ms-TPM-OwnerInformation** attribute for computer objects in the domain.
-Complete the following procedure to check that the correct permissions are set and to remove TPM and BitLocker ACEs from the top-level domain, if necessary.
-
-**Manage ACEs configured on TPM schema objects**
-
-1.  Open the sample script **List-ACEs.vbs**.
-2.  Modify **List-ACEs.vbs**.
-
-    You must modify:
-    -   Value of **strPathToDomain**: Use your domain name.
-    -   Filter options: The script sets a filter to address BitLocker and TPM schema objects, so you must modify **If IsFilterActive ()** if you want to list or remove other schema objects.
-
-3.  Save your modifications to the script.
-4.  Type the following at a command prompt, and then press ENTER:
-
-    **cscript List-ACEs.vbs**
-
-    With this script you can optionally remove ACEs from BitLocker and TPM schema objects on the top-level domain.
-
-## <a href="" id="bkmk-configuregp"></a>Configure Group Policy to back up TPM recovery information in AD DS
-
-Use these procedures to configure the [TPM Group Policy settings](trusted-platform-module-services-group-policy-settings.md#bkmk-tpmgp-addsbu) policy setting on a local computer. In a production environment, an efficient way to do this is to create or edit a Group Policy Object (GPO) that can target client computers in the domain.
-
-**To enable local policy setting to back up TPM recovery information to AD DS**
-
-1.  Sign in to a domain-joined computer by using a domain account that is a member of the local Administrators group.
-2.  Open the Local Group Policy Editor (gpedit.msc), and in the console tree, navigate to **Computer Configuration\\Administrative Templates\\System**.
-3.  Click **Trusted Platform Module Services**.
-4.  Double-click **Turn on TPM backup to Active Directory Domain Services**.
-5.  Click **Enabled**, and then click **OK**.
-> **Important:**  When this setting is enabled, the TPM owner password cannot be set or changed unless the computer is connected to the domain and AD DS backup of the TPM recovery information succeeds.
- 
-## <a href="" id="bkmk-useit"></a>Use AD DS to recover TPM information
-
-When you need to recover the TPM owner information from AD DS and use it to manage the TPM, you need to read the **ms-TPM-OwnerInformation** object from AD DS, and then manually create a TPM owner password backup file that can be supplied when TPM owner credentials are required.
-
-**To obtain TPM owner backup information from AD DS and create a password file**
-
-1.  Sign in to a domain controller by using domain administrator credentials.
-2.  Copy the sample script file, [Get-TPMOwnerInfo.vbs](#bkmk-get-tpmownerinfo), to a location on your computer.
-3.  Open a Command Prompt window, and change the default location to the location of the sample script files you saved in the previous step.
-4.  At the command prompt, type **cscript Get-TPMOwnerInfo.vbs**.
-
-    The expected output is a string that is the hash of the password that you created earlier.
-    > **Note:**  If you receive the error message, "Active Directory: The directory property cannot be found in the cache," verify that you are using a domain administrator account, which is required to read the **ms-TPM-OwnerInformation** attribute.
-    
-    The only exception to this requirement is that if users are the Creator Owner of computer objects that they join to the domain, they can possibly read the TPM owner information for their computer objects.
-     
-5.  Open Notepad or another text editor, and copy the following code sample into the file, and replace *TpmOwnerPasswordHash* with the string that you recorded in the previous step.
-    
-    ``` syntax
-    <?xml version="1.0" encoding="UTF-8"?>
-    <!--
-    This page is a backup of Trusted Platform Module (TPM) owner
-    authorization information. Upon request, use the authorization information to
-    prove ownership of the computer's TPM.
-    IMPORTANT: Please keep this file in a secure location away from your computer's
-    local hard drive.
-    -->
-    <tpmOwnerData version="1.0" softwareAuthor="Microsoft Windows [Version 6.1.7600]" creationDate="2009-11-11T14:39:29-08:00" creationUser="DOMAIN\username" machineName="mymachine">
-                    <tpmInfo manufacturerId="1096043852"/>
-                    <ownerAuth>TpmOwnerPasswordHash</ownerAuth>
-    </tpmOwnerData>
-    ```
-6.  Save this file with a .tpm extension on a removable storage device, such as a USB flash drive. When you access the TPM, and you are required to provide the TPM owner password, choose the option for reading the password from a file and provide the path to this file.
-
-## <a href="" id="bkmk-adds-tpm-scripts"></a>Sample scripts
-
-You can use all or portions of the following sample scripts, which are used in the preceding procedures, to configure AD DS for backing up TPM recovery information. Customization is required depending on how your environment is configured.
-
--   [Add-TPMSelfWriteACE.vbs: Use to add the access control entry (ACE) for the TPM to AD DS](#bkmk-add-tpmselfwriteace)
--   [List-ACEs.vbs: Use to list or remove the ACEs that are configured on BitLocker and TPM schema objects](#bkmk-list-aces)
--   [Get-TPMOwnerInfo.vbs: Use to retrieve the TPM recovery information from AD DS for a particular computer](#bkmk-get-tpmownerinfo)
-
-### <a href="" id="bkmk-add-tpmselfwriteace"></a>Add-TPMSelfWriteACE.vbs
-
-This script adds the access control entry (ACE) for the TPM to AD DS so that the computer can back up TPM recovery information in AD DS.
-
-``` syntax
-'===============================================================================
-'
-' This script demonstrates the addition of an Access Control Entry (ACE)
-' to allow computers to write Trusted Platform Module (TPM) 
-' recovery information to Active Directory.
-'
-' This script creates a SELF ACE on the top-level domain object, and
-' assumes that inheritance of ACL's from the top-level domain object to 
-' down-level computer objects are enabled.
-'
-' 
-'
-' Last Updated: 12/05/2012
-' Last Reviewed: 12/05/2012
-' Microsoft Corporation
-'
-' Disclaimer
-' 
-' The sample scripts are not supported under any Microsoft standard support program
-' or service. The sample scripts are provided AS IS without warranty of any kind. 
-' Microsoft further disclaims all implied warranties including, without limitation, 
-' any implied warranties of merchantability or of fitness for a particular purpose. 
-' The entire risk arising out of the use or performance of the sample scripts and 
-' documentation remains with you. In no event shall Microsoft, its authors, or 
-' anyone else involved in the creation, production, or delivery of the scripts be 
-' liable for any damages whatsoever (including, without limitation, damages for loss 
-' of business profits, business interruption, loss of business information, or 
-' other pecuniary loss) arising out of the use of or inability to use the sample 
-' scripts or documentation, even if Microsoft has been advised of the possibility 
-' of such damages.
-'
-' Version 1.0.2 - Tested and re-released for Windows 8 and Windows Server 2012 
-' 
-'===============================================================================
-' --------------------------------------------------------------------------------
-' Access Control Entry (ACE) constants 
-' --------------------------------------------------------------------------------
-'- From the ADS_ACETYPE_ENUM enumeration
-Const ADS_ACETYPE_ACCESS_ALLOWED_OBJECT      = &H5   'Allows an object to do something
-'- From the ADS_ACEFLAG_ENUM enumeration
-Const ADS_ACEFLAG_INHERIT_ACE                = &H2   'ACE can be inherited to child objects
-Const ADS_ACEFLAG_INHERIT_ONLY_ACE           = &H8   'ACE does NOT apply to target (parent) object
-'- From the ADS_RIGHTS_ENUM enumeration
-Const ADS_RIGHT_DS_WRITE_PROP                = &H20  'The right to write object properties
-Const ADS_RIGHT_DS_CREATE_CHILD              = &H1   'The right to create child objects
-'- From the ADS_FLAGTYPE_ENUM enumeration
-Const ADS_FLAG_OBJECT_TYPE_PRESENT           = &H1   'Target object type is present in the ACE 
-Const ADS_FLAG_INHERITED_OBJECT_TYPE_PRESENT = &H2   'Target inherited object type is present in the ACE 
-' --------------------------------------------------------------------------------
-' TPM and FVE schema object GUID's 
-' --------------------------------------------------------------------------------
-'- ms-TPM-OwnerInformation attribute
-SCHEMA_GUID_MS_TPM_OWNERINFORMATION = "{AA4E1A6D-550D-4E05-8C35-4AFCB917A9FE}"
-'- ms-FVE-RecoveryInformation object
-SCHEMA_GUID_MS_FVE_RECOVERYINFORMATION = "{EA715D30-8F53-40D0-BD1E-6109186D782C}"
-'- Computer object
-SCHEMA_GUID_COMPUTER = "{BF967A86-0DE6-11D0-A285-00AA003049E2}"
-'Reference: "Platform SDK: Active Directory Schema"
-' --------------------------------------------------------------------------------
-' Set up the ACE to allow write of TPM owner information
-' --------------------------------------------------------------------------------
-Set objAce1 = createObject("AccessControlEntry")
-objAce1.AceFlags = ADS_ACEFLAG_INHERIT_ACE + ADS_ACEFLAG_INHERIT_ONLY_ACE
-objAce1.AceType = ADS_ACETYPE_ACCESS_ALLOWED_OBJECT
-objAce1.Flags = ADS_FLAG_OBJECT_TYPE_PRESENT + ADS_FLAG_INHERITED_OBJECT_TYPE_PRESENT
-objAce1.Trustee = "SELF"
-objAce1.AccessMask = ADS_RIGHT_DS_WRITE_PROP 
-objAce1.ObjectType = SCHEMA_GUID_MS_TPM_OWNERINFORMATION
-objAce1.InheritedObjectType = SCHEMA_GUID_COMPUTER
-' --------------------------------------------------------------------------------
-' NOTE: BY default, the "SELF" computer account can create 
-' BitLocker recovery information objects and write BitLocker recovery properties
-'
-' No additional ACE's are needed.
-' --------------------------------------------------------------------------------
-' --------------------------------------------------------------------------------
-' Connect to Discretional ACL (DACL) for domain object
-' --------------------------------------------------------------------------------
-Set objRootLDAP = GetObject("LDAP://rootDSE")
-strPathToDomain = "LDAP://" & objRootLDAP.Get("defaultNamingContext") ' e.g. string dc=fabrikam,dc=com
-Set objDomain = GetObject(strPathToDomain)
-WScript.Echo "Accessing object: " + objDomain.Get("distinguishedName")
-Set objDescriptor = objDomain.Get("ntSecurityDescriptor")
-Set objDacl = objDescriptor.DiscretionaryAcl
- 
-' --------------------------------------------------------------------------------
-' Add the ACEs to the Discretionary ACL (DACL) and set the DACL
-' --------------------------------------------------------------------------------
-objDacl.AddAce objAce1
-objDescriptor.DiscretionaryAcl = objDacl
-objDomain.Put "ntSecurityDescriptor", Array(objDescriptor)
-objDomain.SetInfo
-WScript.Echo "SUCCESS!"
-```
-
-### <a href="" id="bkmk-list-aces"></a>List-ACEs.vbs
-
-This script lists or removes the ACEs that are configured on BitLocker and TPM schema objects for the top-level domain. This enables you to verify that the expected ACEs have been added appropriately or to remove any ACEs that are related to BitLocker or the TPM, if necessary.
-
-``` syntax
-'===============================================================================
-'
-' This script lists the access control entries (ACE's) configured on 
-' Trusted Platform Module (TPM) and BitLocker Drive Encryption (BDE) schema objects 
-' for the top-level domain.
-'
-' You can use this script to check that the correct permissions have been set and
-' to remove TPM and BitLocker ACE's from the top-level domain.
-'
-' 
-' Last Updated: 12/05/2012
-' Last Reviewed: 12/02/2012
-'
-' Microsoft Corporation
-'
-' Disclaimer
-' 
-' The sample scripts are not supported under any Microsoft standard support program
-' or service. The sample scripts are provided AS IS without warranty of any kind. 
-' Microsoft further disclaims all implied warranties including, without limitation, 
-' any implied warranties of merchantability or of fitness for a particular purpose. 
-' The entire risk arising out of the use or performance of the sample scripts and 
-' documentation remains with you. In no event shall Microsoft, its authors, or 
-' anyone else involved in the creation, production, or delivery of the scripts be 
-' liable for any damages whatsoever (including, without limitation, damages for loss 
-' of business profits, business interruption, loss of business information, or 
-' other pecuniary loss) arising out of the use of or inability to use the sample 
-' scripts or documentation, even if Microsoft has been advised of the possibility 
-' of such damages.
-'
-' Version 1.0.2 - Tested and re-released for Windows 8 and Windows Server 2012
-' 
-'===============================================================================
-' --------------------------------------------------------------------------------
-' Usage
-' --------------------------------------------------------------------------------
-Sub ShowUsage
-   Wscript.Echo "USAGE: List-ACEs"
-   Wscript.Echo "List access permissions for BitLocker and TPM schema objects"
-   Wscript.Echo ""
-   Wscript.Echo "USAGE: List-ACEs -remove"
-   Wscript.Echo "Removes access permissions for BitLocker and TPM schema objects"
-   WScript.Quit
-End Sub
-' --------------------------------------------------------------------------------
-' Parse Arguments
-' --------------------------------------------------------------------------------
-Set args = WScript.Arguments
-Select Case args.Count
-  
-  Case 0
-      ' do nothing - checks for ACE's 
-      removeACE = False
-      
-  Case 1
-    If args(0) = "/?" Or args(0) = "-?" Then
-      ShowUsage
-    Else 
-      If UCase(args(0)) = "-REMOVE" Then
-            removeACE = True
-      End If
-    End If
-  Case Else
-    ShowUsage
-End Select
-' --------------------------------------------------------------------------------
-' Configuration of the filter to show/remove only ACE's for BDE and TPM objects
-' --------------------------------------------------------------------------------
-'- ms-TPM-OwnerInformation attribute
-SCHEMA_GUID_MS_TPM_OWNERINFORMATION = "{AA4E1A6D-550D-4E05-8C35-4AFCB917A9FE}"
-'- ms-FVE-RecoveryInformation object
-SCHEMA_GUID_MS_FVE_RECOVERYINFORMATION = "{EA715D30-8F53-40D0-BD1E-6109186D782C}"
-' Use this filter to list/remove only ACEs related to TPM and BitLocker
-aceGuidFilter = Array(SCHEMA_GUID_MS_TPM_OWNERINFORMATION, _
-                      SCHEMA_GUID_MS_FVE_RECOVERYINFORMATION)
-' Note to script source reader:
-' Uncomment the following line to turn off the filter and list all ACEs
-'aceGuidFilter = Array()
-' --------------------------------------------------------------------------------
-' Helper functions related to the list filter for listing or removing ACE's
-' --------------------------------------------------------------------------------
-Function IsFilterActive()
-    If Join(aceGuidFilter) = "" Then
-       IsFilterActive = False
-    Else 
-       IsFilterActive = True
-    End If
-End Function
-Function isAceWithinFilter(ace) 
-    aceWithinFilter = False  ' assume first not pass the filter
-    For Each guid In aceGuidFilter 
-        If ace.ObjectType = guid Or ace.InheritedObjectType = guid Then
-           isAceWithinFilter = True           
-        End If
-    Next
-End Function
-Sub displayFilter
-    For Each guid In aceGuidFilter
-       WScript.echo guid
-    Next
-End Sub
-' --------------------------------------------------------------------------------
-' Connect to Discretional ACL (DACL) for domain object
-' --------------------------------------------------------------------------------
-Set objRootLDAP = GetObject("LDAP://rootDSE")
-strPathToDomain = "LDAP://" & objRootLDAP.Get("defaultNamingContext") ' e.g. dc=fabrikam,dc=com
-Set domain = GetObject(strPathToDomain)
-WScript.Echo "Accessing object: " + domain.Get("distinguishedName")
-WScript.Echo ""
-Set descriptor = domain.Get("ntSecurityDescriptor")
-Set dacl = descriptor.DiscretionaryAcl
-' --------------------------------------------------------------------------------
-' Show Access Control Entries (ACE's)
-' --------------------------------------------------------------------------------
-' Loop through the existing ACEs, including all ACEs if the filter is not active
-i = 1 ' global index
-c = 0 ' found count - relevant if filter is active
-For Each ace In dacl
- If IsFilterActive() = False or isAceWithinFilter(ace) = True Then
-    ' note to script source reader:
-    ' echo i to show the index of the ACE
-    
-    WScript.echo ">            AceFlags: " & ace.AceFlags
-    WScript.echo ">             AceType: " & ace.AceType
-    WScript.echo ">               Flags: " & ace.Flags
-    WScript.echo ">          AccessMask: " & ace.AccessMask
-    WScript.echo ">          ObjectType: " & ace.ObjectType
-    WScript.echo "> InheritedObjectType: " & ace.InheritedObjectType
-    WScript.echo ">             Trustee: " & ace.Trustee
-    WScript.echo ""
-    if IsFilterActive() = True Then
-      c = c + 1
-      ' optionally include this ACE in removal list if configured
-      ' note that the filter being active is a requirement since we don't
-      ' want to accidentally remove all ACEs
-      If removeACE = True Then
-        dacl.RemoveAce ace  
-      End If
-    end if
-  End If 
-  i = i + 1
-Next
-' Display number of ACEs found
-If IsFilterActive() = True Then
-  WScript.echo c & " ACE(s) found in " & domain.Get("distinguishedName") _
-                 & " related to BitLocker and TPM" 'note to script source reader: change this line if you configure your own 
-filter
-  ' note to script source reader: 
-  ' uncomment the following lines if you configure your own filter
-  'WScript.echo ""
-  'WScript.echo "The following filter was active: "
-  'displayFilter
-  'Wscript.echo ""
-Else
-  i = i - 1
-  WScript.echo i & " total ACE(s) found in " & domain.Get("distinguishedName")
-  
-End If
-' --------------------------------------------------------------------------------
-' Optionally remove ACE's on a filtered list
-' --------------------------------------------------------------------------------
-if removeACE = True and IsFilterActive() = True then
-  descriptor.DiscretionaryAcl =  dacl
-  domain.Put "ntSecurityDescriptor", Array(descriptor)
-  domain.setInfo
-  WScript.echo c & " ACE(s) removed from " & domain.Get("distinguishedName")
-else 
-  if removeACE = True then
-    WScript.echo "You must specify a filter to remove ACEs from " & domain.Get("distinguishedName") 
- 
- end if
-end if
-```
-
-### <a href="" id="bkmk-get-tpmownerinfo"></a>Get-TPMOwnerInfo.vbs
-
-This script retrieves TPM recovery information from AD DS for a particular computer so that you can verify that only domain administrators (or delegated roles) can read backed up TPM recovery information and verify that the information is being backed up correctly.
-
-``` syntax
-'=================================================================================
-'
-' This script demonstrates the retrieval of Trusted Platform Module (TPM) 
-' recovery information from Active Directory for a particular computer.
-'
-' It returns the TPM owner information stored as an attribute of a 
-' computer object.
-'
-' Last Updated: 12/05/2012
-' Last Reviewed: 12/05/2012
-'
-' Microsoft Corporation
-'
-' Disclaimer
-' 
-' The sample scripts are not supported under any Microsoft standard support program
-' or service. The sample scripts are provided AS IS without warranty of any kind. 
-' Microsoft further disclaims all implied warranties including, without limitation, 
-' any implied warranties of merchantability or of fitness for a particular purpose. 
-' The entire risk arising out of the use or performance of the sample scripts and 
-' documentation remains with you. In no event shall Microsoft, its authors, or 
-' anyone else involved in the creation, production, or delivery of the scripts be 
-' liable for any damages whatsoever (including, without limitation, damages for loss 
-' of business profits, business interruption, loss of business information, or 
-' other pecuniary loss) arising out of the use of or inability to use the sample 
-' scripts or documentation, even if Microsoft has been advised of the possibility 
-' of such damages.
-'
-' Version 1.0 - Initial release
-' Version 1.1 - Updated GetStrPathToComputer to search the global catalog.
-' Version 1.1.2 - Tested and re-released for Windows 8 and Windows Server 2012
-' 
-'=================================================================================
-' --------------------------------------------------------------------------------
-' Usage
-' --------------------------------------------------------------------------------
-Sub ShowUsage
-   Wscript.Echo "USAGE: Get-TpmOwnerInfo [Optional Computer Name]"
-   Wscript.Echo "If no computer name is specified, the local computer is assumed."
-   WScript.Quit
-End Sub
-' --------------------------------------------------------------------------------
-' Parse Arguments
-' --------------------------------------------------------------------------------
-Set args = WScript.Arguments
-Select Case args.Count
-  
-  Case 0
-      ' Get the name of the local computer      
-      Set objNetwork = CreateObject("WScript.Network")
-      strComputerName = objNetwork.ComputerName
-    
-  Case 1
-    If args(0) = "/?" Or args(0) = "-?" Then
-      ShowUsage
-    Else
-      strComputerName = args(0)
-    End If
-  
-  Case Else
-    ShowUsage
-End Select
-' --------------------------------------------------------------------------------
-' Get path to Active Directory computer object associated with the computer name
-' --------------------------------------------------------------------------------
-Function GetStrPathToComputer(strComputerName) 
-    ' Uses the global catalog to find the computer in the forest
-    ' Search also includes deleted computers in the tombstone
-    Set objRootLDAP = GetObject("LDAP://rootDSE")
-    namingContext = objRootLDAP.Get("defaultNamingContext") ' e.g. string dc=fabrikam,dc=com    
-    strBase = "<GC://" & namingContext & ">"
- 
-    Set objConnection = CreateObject("ADODB.Connection") 
-    Set objCommand = CreateObject("ADODB.Command") 
-    objConnection.Provider = "ADsDSOOBject" 
-    objConnection.Open "Active Directory Provider" 
-    Set objCommand.ActiveConnection = objConnection 
-    strFilter = "(&(objectCategory=Computer)(cn=" &  strComputerName & "))"
-    strQuery = strBase & ";" & strFilter  & ";distinguishedName;subtree" 
-    objCommand.CommandText = strQuery 
-    objCommand.Properties("Page Size") = 100 
-    objCommand.Properties("Timeout") = 100
-    objCommand.Properties("Cache Results") = False 
-    ' Enumerate all objects found. 
-    Set objRecordSet = objCommand.Execute 
-    If objRecordSet.EOF Then
-      WScript.echo "The computer name '" &  strComputerName & "' cannot be found."
-      WScript.Quit 1
-    End If
-    ' Found object matching name
-    Do Until objRecordSet.EOF 
-      dnFound = objRecordSet.Fields("distinguishedName")
-      GetStrPathToComputer = "LDAP://" & dnFound
-      objRecordSet.MoveNext 
-    Loop 
-    ' Clean up. 
-    Set objConnection = Nothing 
-    Set objCommand = Nothing 
-    Set objRecordSet = Nothing 
-End Function
-' --------------------------------------------------------------------------------
-' Securely access the Active Directory computer object using Kerberos
-' --------------------------------------------------------------------------------
-Set objDSO = GetObject("LDAP:")
-strPath = GetStrPathToComputer(strComputerName)
-WScript.Echo "Accessing object: " + strPath
-Const ADS_SECURE_AUTHENTICATION = 1
-Const ADS_USE_SEALING = 64 '0x40
-Const ADS_USE_SIGNING = 128 '0x80
-Set objComputer = objDSO.OpenDSObject(strPath, vbNullString, vbNullString, _
-                                   ADS_SECURE_AUTHENTICATION + ADS_USE_SEALING + ADS_USE_SIGNING)
-' --------------------------------------------------------------------------------
-' Get the TPM owner information from the Active Directory computer object
-' --------------------------------------------------------------------------------
-strOwnerInformation = objComputer.Get("msTPM-OwnerInformation")
-WScript.echo "msTPM-OwnerInformation: " + strOwnerInformation
-```
-
-## Additional resources
-
-- [Trusted Platform Module technology overview](trusted-platform-module-overview.md)
-- [TPM fundamentals](tpm-fundamentals.md)
-- [TPM Group Policy settings](trusted-platform-module-services-group-policy-settings.md)
-- [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx)
-- [AD DS schema extensions to support TPM backup](ad-ds-schema-extensions-to-support-tpm-backup.md)
-- [Prepare your organization for BitLocker: Planning and Policies](http://technet.microsoft.com/library/jj592683.aspx), see TPM considerations
+- [Trusted Platform Module](trusted-platform-module-top-node.md) (list of topics)
+- [TPM Group Policy settings](trusted-platform-module-services-group-policy-settings.md) 

windows/keep-secure/basic-audit-logon-events.md

@@ -22,6 +22,8 @@ If you define this policy setting, you can specify whether to audit successes, a
 
 To set this value to **No auditing**, in the **Properties** dialog box for this policy setting, select the **Define these policy settings** check box and clear the **Success** and **Failure** check boxes.
 
+For information about advanced security policy settings for logon events, see the [Logon/logoff](advanced-security-audit-policy-settings.md#logonlogoff) section in [Advanced security audit policy settings](advanced-security-audit-policy-settings.md).
+
 ## Configure this audit setting
 
 You can configure this security setting by opening the appropriate policy under Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Audit Policy.

windows/keep-secure/bitlocker-countermeasures.md

@@ -23,9 +23,9 @@ The sections that follow provide more detailed information about the different t
 
 ### Protection before startup
 
-Before Windows starts, you must rely on security features implemented as part of the device hardware, including TPM andSecure Boot. Fortunately, many modern computers feature TPM.
+Before Windows starts, you must rely on security features implemented as part of the device hardware, including TPM and Secure Boot. Fortunately, many modern computers feature TPM.
 
-**Trusted Platform Module**
+#### Trusted Platform Module
 
 Software alone isn’t sufficient to protect a system. After an attacker has compromised software, the software might be unable to detect the compromise. Therefore, a single successful software compromise results in an untrusted system that might never be detected. Hardware, however, is much more difficult to modify.
 
@@ -33,7 +33,7 @@ A TPM is a microchip designed to provide basic security-related functions, prima
 By binding the BitLocker encryption key with the TPM and properly configuring the device, it’s nearly impossible for an attacker to gain access to the BitLocker-encrypted data without obtaining an authorized user’s credentials. Therefore, computers with a TPM can provide a high level of protection against attacks that attempt to directly retrieve the BitLocker encryption key.
 For more info about TPM, see [Trusted Platform Module](trusted-platform-module-overview.md).
 
-**UEFI and Secure Boot**
+#### UEFI and Secure Boot
 
 No operating system can protect a device when the operating system is offline. For that reason, Microsoft worked closely with hardware vendors to require firmware-level protection against boot and rootkits that might compromise an encryption solution’s encryption keys.
 
@@ -53,7 +53,7 @@ Using the digital signature, UEFI verifies that the bootloader was signed using
 
 If the bootloader passes these two tests, UEFI knows that the bootloader isn’t a bootkit and starts it. At this point, Trusted Boot takes over, and the Windows bootloader, using the same cryptographic technologies that UEFI used to verify the bootloader, then verifies that the Windows system files haven’t been changed.
 
-All Windows 8–certified devices must meet several requirements related to UEFI-based Secure Boot:
+Starting with Windows 8, certified devices must meet several requirements related to UEFI-based Secure Boot:
 
 -   They must have Secure Boot enabled by default.
 -   They must trust Microsoft’s certificate (and thus any bootloader Microsoft has signed).

windows/keep-secure/bitlocker-group-policy-settings.md

@@ -1509,7 +1509,6 @@ If the **Require BitLocker backup to AD DS** option is not selected, AD DS bac
 TPM initialization might be needed during the BitLocker setup. Enable the **Turn on TPM backup to Active Directory Domain Services** policy setting in **Computer Configuration\\Administrative Templates\\System\\Trusted Platform Module Services** to ensure that TPM information is also backed up.
 
 For more information about this setting, see [TPM Group Policy settings](trusted-platform-module-services-group-policy-settings.md).
-If you are using domain controllers running Windows Server 2003 with Service Pack 1, you must first set up appropriate schema extensions and access control settings on the domain before a backup to AD DS can succeed. For more info, see [Backup the TPM recovery Information to AD DS](backup-tpm-recovery-information-to-ad-ds.md).
 
 ### <a href="" id="bkmk-rec4"></a>Choose default folder for recovery password
 

windows/keep-secure/bitlocker-how-to-enable-network-unlock.md

@@ -231,7 +231,7 @@ The following steps detail how to create a certificate template for use with Bit
 
 1.  Open the Certificates Template snap-in (certtmpl.msc).
 2.  Locate the User template. Right-click the template name and select **Duplicate Template**.
-3.  On the **Compatibility** tab, change the **Certification Authority** and **Certificate recipient** fields to Windows Server 2012 and Windows 8respectively. Ensure the **Show resulting changes** dialog box is selected.
+3.  On the **Compatibility** tab, change the **Certification Authority** and **Certificate recipient** fields to Windows Server 2012 and Windows 8 respectively. Ensure the **Show resulting changes** dialog box is selected.
 4.  Select the **General** tab of the template. The **Template display name** and **Template name** should clearly identify that the template will be used for Network Unlock. Clear the checkbox for the **Publish certificate in Active Directory** option.
 5.  Select the **Request Handling** tab. Select **Encryption** from the **Purpose** drop down menu. Ensure the **Allow private key to be exported** option is selected.
 6.  Select the **Cryptography** tab. Set the **Minimum key size** to 2048. (Any Microsoft cryptographic provider that supports RSA can be used for this template, but for simplicity and forward compatibility we recommend using the **Microsoft Software Key Storage Provider**.)

windows/keep-secure/bitlocker-overview.md

@@ -42,7 +42,7 @@ BitLocker control panel, and they are appropriate to use for automated deploymen
 
 ## <a href="" id="bkmk-new"></a>New and changed functionality
 
-To find out what's new in BitLocker for Windows 10, see [What's new in BitLocker?](../whats-new/bitlocker.md)
+To find out what's new in BitLocker for Windows 10, see the [BitLocker](https://technet.microsoft.com/itpro/windows/whats-new/whats-new-windows-10-version-1507-and-1511#bitlocker) section in "What's new in Windows 10, versions 1507 and 1511."
  
 ## System requirements
 
@@ -74,6 +74,7 @@ When installing the BitLocker optional component on a server you will also need
 | [BitLocker: How to enable Network Unlock](bitlocker-how-to-enable-network-unlock.md) | This topic for the IT professional describes how BitLocker Network Unlock works and how to configure it. |
 | [BitLocker: Use BitLocker Drive Encryption Tools to manage BitLocker](bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md)| This topic for the IT professional describes how to use tools to manage BitLocker.| 
 | [BitLocker: Use BitLocker Recovery Password Viewer](bitlocker-use-bitlocker-recovery-password-viewer.md) | This topic for the IT professional describes how to use the BitLocker Recovery Password Viewer. |
+| [BitLocker Group Policy settings](bitlocker-group-policy-settings.md) | This topic for IT professionals describes the function, location, and effect of each Group Policy setting that is used to manage BitLocker. |
 | [BCD settings and BitLocker](bcd-settings-and-bitlocker.md) | This topic for IT professionals describes the BCD settings that are used by BitLocker.| 
 | [BitLocker Recovery Guide](bitlocker-recovery-guide-plan.md)| This topic for IT professionals describes how to recover BitLocker keys from AD DS. |
 | [Protect BitLocker from pre-boot attacks](protect-bitlocker-from-pre-boot-attacks.md)| This detailed guide will help you understand the circumstances under which the use of pre-boot authentication is recommended for devices running Windows 10, Windows 8.1, Windows 8, or Windows 7; and when it can be safely omitted from a device’s configuration. |

windows/keep-secure/change-history-for-keep-windows-10-secure.md

@@ -12,11 +12,21 @@ author: brianlic-msft
 # Change history for Keep Windows 10 secure
 This topic lists new and updated topics in the [Keep Windows 10 secure](index.md) documentation for [Windows 10 and Windows 10 Mobile](../index.md).
 
-## December 2016
-| New or changed topic | Description |
-| --- | --- |
+
+## January 2017
+|New or changed topic |Description |
+|---------------------|------------|
+|[Recommended Enterprise Cloud Resources and Neutral Resources network settings with Windows Information Protection (WIP)](recommended-network-definitions-for-wip.md) |New |
+|[Using Outlook Web Access with Windows Information Protection (WIP)](using-owa-with-wip.md) |New |
 | Microsoft Passport guide | Content merged into [Manage identity verification using Windows Hello for Business](hello-manage-identity-verification.md) topics |
 
+## December 2016
+|New or changed topic |Description |
+|---------------------|------------|
+|[Create WMI Filters for the GPO](create-wmi-filters-for-the-gpo.md) |Added filter examples for Windows 10 and Windows Server 2016. |
+
+
+
 ## November 2016
 | New or changed topic | Description |
 | --- | --- |

windows/keep-secure/change-the-tpm-owner-password.md

@@ -12,52 +12,35 @@ author: brianlic-msft
 # Change the TPM owner password
 
 **Applies to**
--   Windows 10
+-   Windows 10, version 1511
+-   Windows 10, version 1507
 
 This topic for the IT professional describes how to change the password or PIN for the owner of the Trusted Platform Module (TPM) that is installed on your system.
 
 ## About the TPM owner password
-Starting with Windows 10, version 1607 , Windows will not retain the TPM owner password when provisioning the TPM.  The password will be set to a random high entropy value and then discarded.
 
-In order to retain the TPM owner password, you will need to set the registry key 'HKLM\Software\Policies\Microsoft\TPM' [REG_DWORD] 'OSManagedAuthLevel' to 4.  The default value for this key is 2, and unless it is changed to 4 before the TPM is provisioned, the owner password will not be saved.  Microsoft strongly recommends that you do not change the default value of this registry key in order to retain the owner password.
+Starting with Windows 10, version 1607, Windows will not retain the TPM owner password when provisioning the TPM. The password will be set to a random high entropy value and then discarded.
 
-Only one owner password exists for each TPM. The TPM owner password allows the ability to enable, disable, or clear the TPM without having physical access to the computer, for example, by using the command-line tools remotely. The TPM owner password also allows manipulation of the TPM dictionary attack logic.  Taking ownership of the TPM is performed by Windows as part of the provisioning process on each boot. Ownership can change when you share the password or clear your ownership of the TPM so someone else can initialize it.
+> [!IMPORTANT]
+> Although the TPM owner password is not retained starting with Windows 10, version 1607, you can change a default registry key to retain it. However, we strongly recommend that you do not make this change. To retain the TPM owner password, set the registry key 'HKLM\\Software\\Policies\\Microsoft\\TPM' \[REG\_DWORD\] 'OSManagedAuthLevel' to 4. The default value for this key is 2, and unless it is changed to 4 before the TPM is provisioned, the owner password will not be saved.
+
+Only one owner password exists for each TPM. The TPM owner password allows the ability to enable, disable, or clear the TPM without having physical access to the computer, for example, by using the command-line tools remotely. The TPM owner password also allows manipulation of the TPM dictionary attack logic. Taking ownership of the TPM is performed by Windows as part of the provisioning process on each boot. Ownership can change when you share the password or clear your ownership of the TPM so someone else can initialize it.
 
 Without the owner password you can still perform all the preceding actions by means of a physical presence confirmation from UEFI.
 
-**Other TPM management options**
+### Other TPM management options
 
 Instead of changing your owner password, you can also use the following options to manage your TPM:
 
--   **Clear the TPM**   If you want to invalidate all of the existing keys that have been created since you took ownership of the TPM, you can clear it. For more info, see [Initialize and Configure Ownership of the TPM](initialize-and-configure-ownership-of-the-tpm.md#bkmk-clear1).
+-   **Clear the TPM**   If you want to invalidate all of the existing keys that have been created since you took ownership of the TPM, you can clear it. For important precautions for this process, and instructions for completing it, see [Clear all the keys from the TPM](initialize-and-configure-ownership-of-the-tpm.md#clear-all-the-keys-from-the-tpm).
 
-    >**Important:**  Clearing the TPM can result in the loss of data. To avoid data loss, make sure you have a backup or recovery method for any data protected or encrypted by the TPM.
-     
--   **Turn off the TPM**   If you want to keep all existing keys and data intact, and you want to disable the services that are provided by the TPM, you can turn it off. For more info, see [Initialize and Configure Ownership of the TPM](initialize-and-configure-ownership-of-the-tpm.md#bkmk-onoff). This option is only available for TPM 1.2.
+-   **Turn off the TPM**   With TPM 1.2 and Windows 10, versions 1507 and 1511, you can turn off the TPM. Do this if you want to keep all existing keys and data intact and disable the services that are provided by the TPM. For more info, see [Turn off the TPM](initialize-and-configure-ownership-of-the-tpm.md#turn-off-the-tpm).
 
 ## Change the TPM owner password
 
-The following procedure provides the steps that are necessary to change the TPM owner password.
+With Windows 10, version 1507 or 1511, if you have opted specifically to preserve the TPM owner password, you can use the saved password to change to a new password.
 
-**To change the TPM owner password**
-
-If you have opted specifically to preserve the TPM owner password, you can use the saved password to change to a new password.
-
-1.  Open the TPM MMC (tpm.msc). If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then click **Yes**.
-2.  In the **Actions** pane, click **Change Owner Password**.
-3.  In the **Manage the TPM security hardware** dialog box, select a method to enter your current TPM owner password.
-
-    -   If you saved your TPM owner password on a removable storage device, insert it, and then click **I have the owner password file**. In the **Select backup file with the TPM owner password** dialog box, use **Browse** to navigate to the .tpm file that is saved on your removable storage device. Click **Open**, and then click **Create New Password**.
-    -   If you do not have the removable storage device with your saved password, click **I want to enter the owner password**. In the **Type your TPM owner password** dialog box, enter your password (including hyphens), and click **Create New Password**.
-4.  On the **Create the TPM owner password** page, select a method for creating a new TPM owner password.
-
-    1.  Click **Automatically create the password** to have a new owner password generated for you.
-    2.  Click **Manually create the password** if you want to specify a password.
-        >**Note:**  The TPM owner password must have a minimum of eight characters.
-         
-5.  After the new password is created, you can choose **Save the password** to save the password in a password backup file on a removable storage device or **Print the password** to print a copy of the password for later reference.
-
-6.  Click **Change password** to apply the new owner password to the TPM.
+To change to a new TPM owner password, in TPM.msc, click **Change Owner Password**, and follow the instructions. You will be prompted to provide the owner password file or to type the password. Then you can create a new password, either automatically or manually, and save the password in a file or as a printout.
 
 ## Use the TPM cmdlets
 
@@ -66,6 +49,6 @@ If you are using Windows PowerShell to manage your computers, you can also manag
 
 For details about the individual cmdlets, see [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx).
 
-## Additional resources
+## Related topics
 
-For more info about TPM, see [Trusted Platform Module technology overview](trusted-platform-module-overview.md#bkmk-additionalresources).
+- [Trusted Platform Module](trusted-platform-module-top-node.md) (list of topics)

windows/keep-secure/configure-aad-windows-defender-advanced-threat-protection.md

@@ -24,7 +24,7 @@ localizationpriority: high
 
 You need to add an application in your Azure Active Directory (AAD) tenant then authorize the Windows Defender ATP Alerts Export application  to communicate with it so that your security information and events management (SIEM) tool can consume alerts from Windows Defender ATP portal.
 
-1. Login to the [Azure management portal](https://manage.windowsazure.com).
+1. Login to the [Azure management portal](https://ms.portal.azure.com).
 
 2. Select **Active Directory**.
 
@@ -53,14 +53,12 @@ You need to add an application in your Azure Active Directory (AAD) tenant then
 
 13. Click **Save** and copy the key in a safe place. You'll need this key to authenticate the client application on Azure Active Directory.
 
-14. Open a web browser and connect to the following URL: <br>
-```text
-https://DataAccess-PRD.trafficmanager.net:444/api/FetchToken?clientId=f7c1acd8-0458-48a0-a662-dba6de049d1c&tenantId=<tenant ID>&clientSecret=1234
-```
-An Azure login page appears.
-> [!NOTE]
-> - Replace *tenant ID* with your actual tenant ID.
-> - Keep the client secret as is. This is a dummy value, but the parameter must appear.
+14. Open a web browser and connect to the following URL: `https://DataAccess-PRD.trafficmanager.net:444/api/FetchToken?clientId=f7c1acd8-0458-48a0-a662-dba6de049d1c&tenantId=<tenant ID>&clientSecret=1234`<br>
+
+  An Azure login page appears.
+  > [!NOTE]
+  > - Replace *tenant ID* with your actual tenant ID.  
+  > - Keep the *clientSecret* as is. This is a dummy value, but the parameter must appear.
 
 15. Sign in with the credentials of a user from your tenant.
 
@@ -80,7 +78,37 @@ An Azure login page appears.
 
 23. Save the application changes.
 
-After configuring the application in AAD, you can continue to configure the SIEM tool that you want to use.
+After configuring the application in AAD, you'll need to obtain a refresh token. You'll need to use the token when you configure the connector for your SIEM tool in the next steps. The token lets the connector access Windows Defender ATP events to be consumed by your SIEM.
+
+## Obtain a refresh token using an events URL
+Obtain a refresh token used to retrieve the Windows Defender Advanced Threat Protection events to your SIEM. This section provides information on how you can use an events URL to obtain the required refresh token.
+>[!NOTE]
+>For HP ArcSight, you can obtain a refresh token using the restutil tool. For more information, see [Configure HP ArcSight to consume alerts](configure-arcsight-windows-defender-advanced-threat-protection.md).
+
+### Before you begin
+Get the following information from your Azure Active Directory (AAD) application by selecting the **View Endpoint** on the application configuration page:
+
+    - OAuth 2 Client ID
+    - OAuth 2 Client secret
+
+You'll use these values to obtain a refresh token.
+
+>[!IMPORTANT]
+>Before using the OAuth 2 Client secret described in the next steps, you **must** encode it. Use a URL encoder to transform the OAuth 2 client secret.
+
+### Obtain a refresh token
+1. Open a web browser and connect to the following URL: `https://DataAccess-PRD.trafficmanager.net:444/api/FetchToken?clientId=<client ID>&tenantId=<tenant ID>&clientSecret=<client secret>`
+
+  >[!NOTE]
+  >- Replace the *client ID* value with the one you got from your AAD application.
+  >- Replace *tenant ID* with your actual tenant ID.
+  >- Replace *client secret* with your encoded client secret. The client secret **must** be pasted encoded.
+
+2. Click **Accept**. When you authenticate, a web page opens with your refresh token.
+
+3.  Save the refresh token which you'll find it the `<RefreshToken></RefreshToken>`value. You'll need this value when configuring your SIEM tool.
+
+After configuring your AAD application and generating a refresh token, you can proceed to configure your SIEM tool.
 
 ## Related topics
 - [Configure security information and events management (SIEM) tools to consume alerts](configure-siem-windows-defender-advanced-threat-protection.md)

windows/keep-secure/configure-arcsight-windows-defender-advanced-threat-protection.md

@@ -25,26 +25,36 @@ You'll need to configure HP ArcSight so that it can consume Windows Defender ATP
 
 ## Before you begin
 
-- Get the following information from your Azure Active Directory (AAD) application by selecting the **View Endpoint** on the application configuration page:
+- Get the following information from your Azure Active Directory (AAD) application by selecting **View Endpoint** on the application configuration page:
     - OAuth 2 Token refresh URL
     - OAuth 2 Client ID
     - OAuth 2 Client secret
-- Create your OAUth 2 Client properties file or get it from your Windows Defender ATP contact. For more information, see the ArcSight FlexConnector Developer's guide.
+- Download the [WDATP-connector.properties](http://download.microsoft.com/download/3/9/C/39C703C2-487C-4C3E-AFD8-14C2253C2F12/WDATP-connector.properties) file and update the following values:
 
-  > [!NOTE]
-  > **For the authorization URL**: Append the following to the value you got from the AAD app: ```?resource=https%3A%2F%2FWDATPAlertExport.Seville.onmicrosoft.com``` <br>
-  > **For the redirect_uri value use**: ```https://localhost:44300/wdatpconnector```
-  >
-- Get the *wdatp-connector.properties* file from your Windows Defender ATP contact. This file is used to parse the information from Windows Defender ATP to HP ArcSight consumable format.
-- Install the HP ArcSight REST FlexConnector package on a server that has access to the Internet.
-- Contact the Windows Defender ATP team to get your refresh token or follow the steps in the section "Run restutil to Obtain a Refresh Token for Connector Appliance/ArcSight Management Center" in the ArcSight FlexConnector Developer's guide.
+  - **client_ID**: OAuth 2 Client ID
+  - **client_secret**: OAuth 2 Client secret
+  - **auth_url**:  ```https://login.microsoftonline.com/<tenantID>?resource=https%3A%2F%2FWDATPAlertExport.Seville.onmicrosoft.com ```
+
+    >[!NOTE]
+    >Replace *tenantID* with your tenant ID.
+
+  - **token_url**: `https://login.microsoftonline.com/<tenantID>/oauth2/token`
+
+    >[!NOTE]
+    >Replace the *tenantID* value with your tenant ID.
+
+  - **redirect_uri**: ```https://localhost:44300/wdatpconnector```
+  - **scope**: Leave the value blank
+
+- Download the [WDATP-connector.jsonparser.properties](http://download.microsoft.com/download/0/8/A/08A4957D-0923-4353-B25F-395EAE363E8C/WDATP-connector.jsonparser.properties) file. This file is used to parse the information from Windows Defender ATP to HP ArcSight consumable format.
+- Install the HP ArcSight REST FlexConnector package. You can find this in the HPE Software center. Install the package on a server that has access to the Internet.
 
 ## Configure HP ArcSight
-The following steps assume that you have completed all the required steps in [Before you begin](#before-you-begin).
+The following steps assume that you have completed all the required steps in [Before you begin](#before-you-begin). For more information, see the ArcSight FlexConnector Developer's guide.
 
-1. Copy the *wdatp-connector.jsonparser.properties* file into the `<root>\current\user\agent\flexagent` folder of the connector installation folder.
+1. Save the [WDATP-connector.jsonparser.properties file](http://download.microsoft.com/download/0/8/A/08A4957D-0923-4353-B25F-395EAE363E8C/WDATP-connector.jsonparser.properties) file into the connector installation folder. The
 
-2. Save the *wdatp-connector.properties* file into a folder of your choosing.
+2. Save the [WDATP-connector.properties](http://download.microsoft.com/download/3/9/C/39C703C2-487C-4C3E-AFD8-14C2253C2F12/WDATP-connector.properties) file into the `<root>\current\user\agent\flexagent` folder of the connector installation folder.
 
 3. Open an elevated command-line:
 
@@ -69,7 +79,7 @@ The following steps assume that you have completed all the required steps in [Be
     <td>Type in the name of the client property file. It must match the client property file.</td>
     </tr>
     <td>Events URL</td>
-    <td>`https://DataAccess-PRD.trafficmanager.net:444/api/alerts`</td>
+    <td>Depending on the location of your datacenter, select either the EU or the US URL: </br></br> **For EU**:  https://<i></i>wdatp-alertexporter-eu.securitycenter.windows.com/api/alerts </br>**For US:** https://<i></i>wdatp-alertexporter-us.securitycenter.windows.com/api/alerts</td>
     <tr>
     <td>Authentication Type</td>
     <td>OAuth 2</td>
@@ -78,7 +88,8 @@ The following steps assume that you have completed all the required steps in [Be
     <td>Select *wdatp-connector.properties*.</td>
     <tr>
     <td>Refresh Token</td>
-    <td>Paste the refresh token that your Windows Defender ATP contact provided, or run the `restutil` tool to get it.</td>
+    <td>You can use the Windows Defender ATP events URL or the restutil tool to get obtain a refresh token. <br> For more information on getting your refresh token using the events URL, see [Obtain a refresh token](configure-aad-windows-defender-advanced-threat-protection.md#obtain-a-refresh-token). </br> </br>**To get your refresh token using the restutil tool:** </br> a. Open a command prompt. Navigate to `C:\ArcSightSmartConnectors\<descriptive_name>\current\bin`. </br></br> b. Type: `arcsight restutil token -config C:\ArcSightSmartConnectors_Prod\WDATP\WDATP-connector.properties`. A Web browser window will open. </br> </br>c. Type in your credentials then click on the password field to let the page redirect. In the login prompt, enter your credentials. </br> </br>d.	A refresh token is shown in the command prompt. </br></br> e. Paste the value in the form.
+    </td>
     </tr>
     </tr>
     </table>

windows/keep-secure/configure-endpoints-script-windows-defender-advanced-threat-protection.md

@@ -45,7 +45,7 @@ You can also manually onboard individual endpoints to Windows Defender ATP. You
 
 5.  Press the **Enter** key or click **OK**.
 
-For for information on how you can manually validate that the endpoint is compliant and correctly reports telemetry see, [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md).
+For for information on how you can manually validate that the endpoint is compliant and correctly reports sensor data see, [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md).
 
 ## Configure sample collection settings
 For each endpoint, you can set a configuration value to state whether samples can be collected from the endpoint when a request is made through the Windows Defender ATP portal to submit a file for deep analysis.

windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md

@@ -21,7 +21,7 @@ localizationpriority: high
 - Windows 10 Pro Education
 - Windows Defender Advanced Threat Protection (Windows Defender ATP)
 
-Endpoints in your organization must be configured so that the Windows Defender ATP service can get telemetry from them. There are various methods and deployment tools that you can use to configure the endpoints in your organization.
+Endpoints in your organization must be configured so that the Windows Defender ATP service can get sensor data from them. There are various methods and deployment tools that you can use to configure the endpoints in your organization.
 
 Windows Defender ATP supports the following deployment tools and methods:
 

windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md

@@ -22,7 +22,7 @@ localizationpriority: high
 - Windows 10 Pro Education
 - Windows Defender Advanced Threat Protection (Windows Defender ATP)
 
-The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to report telemetry and communicate with the Windows Defender ATP service.
+The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to report sensor data and communicate with the Windows Defender ATP service.
 
 The embedded Windows Defender ATP sensor runs in system context using the LocalSystem account. The sensor uses Microsoft Windows HTTP Services (WinHTTP) to enable communication with the Windows Defender ATP cloud service.
 

windows/keep-secure/configure-splunk-windows-defender-advanced-threat-protection.md

@@ -25,9 +25,9 @@ You'll need to configure Splunk so that it can consume Windows Defender ATP aler
 
 ## Before you begin
 
-- Install the [REST API Modular Input app](https://splunkbase.splunk.com/app/1546/) in Splunk
-- Contact the Windows Defender ATP team to get your refresh token
-- Get the following information from your Azure Active Directory (AAD) application by selecting the **View Endpoint** on the application configuration page:
+- Install the [REST API Modular Input app](https://splunkbase.splunk.com/app/1546/) in Splunk.
+- Obtain your refresh token. For more information, see [Obtain a refresh token](configure-aad-windows-defender-advanced-threat-protection.md#obtain-a-refresh-token).
+- Get the following information from your Azure Active Directory (AAD) application by selecting **View Endpoint** on the application configuration page:
     - OAuth 2 Token refresh URL
     - OAuth 2 Client ID
     - OAuth 2 Client secret
@@ -56,7 +56,8 @@ You'll need to configure Splunk so that it can consume Windows Defender ATP aler
   </tr>
   <tr>
   <td>Endpoint URL</td>
-  <td> https://<i></i>DataAccess-PRD.trafficmanager.net:444/api/alerts</td>
+  <td>Depending on the location of your datacenter, select either the EU or the US URL: </br></br> **For EU**:  https://<i></i>wdatp-alertexporter-eu.securitycenter.windows.com/api/alerts </br>**For US:** https://<i></i>wdatp-alertexporter-us.securitycenter.windows.com/api/alerts
+
   </tr>
   <tr>
   <td>HTTP Method</td>

windows/keep-secure/credential-guard.md

@@ -61,7 +61,7 @@ The following tables provide more information about the hardware, firmware, and
 | Hardware: **Trusted Platform Module (TPM)**  |  **Requirement**: TPM 1.2 or TPM 2.0, either discrete or firmware.<br><br>**Security benefits**: A TPM provides protection for VBS encryption keys that are stored in the firmware. This helps protect against attacks involving a physically present user with BIOS access. |
 | Firmware: **UEFI firmware version 2.3.1.c or higher with UEFI Secure Boot** | **Requirements**: See the following Windows Hardware Compatibility Program requirement: [System.Fundamentals.Firmware.UEFISecureBoot](http://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot)<br><br>**Security benefits**: UEFI Secure Boot helps ensure that the device boots only authorized code. This can prevent boot kits and root kits from installing and persisting across reboots.  |
 | Firmware: **Secure firmware update process**      | **Requirements**: UEFI firmware must support secure firmware update found under the following Windows Hardware Compatibility Program requirement: [System.Fundamentals.Firmware.UEFISecureBoot](http://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot).<br><br>**Security benefits**: UEFI firmware just like software can have security vulnerabilities that, when found, need to be patched through firmware updates. Patching helps prevent root kits from getting installed. |
-| Software: Qualified **Windows operating system**  | **Requirement**: Windows 10 Enterprise, Windows 10 Education, Windows 2016 Server, or Windows Enterprise IoT<br><br>**Security benefits**: Support for VBS and for management features that simplify configuration of Credential Guard. |
+| Software: Qualified **Windows operating system**  | **Requirement**: Windows 10 Enterprise, Windows 10 Education, Windows 2016 Server, or Windows Enterprise IoT<br><br><blockquote><p><strong>Important:</strong><br> Windows Server 2016 running as a domain controller does not support Credential Guard. Only Device Guard is supported in this configuration.</p></blockquote><br>**Security benefits**: Support for VBS and for management features that simplify configuration of Credential Guard. |
 
 > [!IMPORTANT]
 > The preceding table lists requirements for baseline protections. The following tables list requirements for improved security. You can use Credential Guard with hardware, firmware, and software that support baseline protections, even if they do not support protections for improved security. However, we strongly recommend meeting the requirements for improved security, to significantly strengthen the level of security that Credential Guard can provide.

windows/keep-secure/export-an-applocker-policy-from-a-gpo.md

@@ -16,7 +16,7 @@ author: brianlic-msft
 
 This topic for IT professionals describes the steps to export an AppLocker policy from a Group Policy Object (GPO) so that it can be modified.
 
-Updating an AppLocker policy that is currently enforced in your production environment can have unintended results. Therefore, export the policy from the GPO and update the rule or rules by using AppLocker on your AppLocker reference device
+Updating an AppLocker policy that is currently enforced in your production environment can have unintended results. Therefore, export the policy from the GPO and update the rule or rules by using AppLocker on your AppLocker reference device.
 
 To complete this procedure, you must have the **Edit Setting** permission to edit a GPO. By default, members of the **Domain Admins** group, the **Enterprise Admins** group, and the **Group Policy Creator Owners** group have this permission.
 

windows/keep-secure/guidance-and-best-practices-wip.md

@@ -22,11 +22,10 @@ This section includes info about the enlightened Microsoft apps, including how t
 ## In this section
 |Topic |Description |
 |------|------------|
-|[Windows Information Protection (WIP) overview](wip-enterprise-overview.md) |High-level overview info about why to use WIP, the enterprise scenarios, and how to turn it off. |
-|[Mandatory settings for Windows Information Protection (WIP)](mandatory-settings-for-wip.md) |A list of all of the tasks and settings that are required for the operating system to turn on Windows Information Protection (WIP), formerly known as enterprise data protection (EDP), in your enterprise. |
-|[Enlightened apps for use with Windows Information Protection (WIP)](enlightened-microsoft-apps-and-wip.md) |Learn the difference between enlightened and unenlightened apps, and then review the list of enlightened apps provided by Microsoft along with the text you will need to use to add them to your allowed apps list. |
-|[Testing scenarios for Windows Information Protection (WIP)](testing-scenarios-for-wip.md) |We've come up with a list of suggested testing scenarios that you can use to test WIP in your company. |
-|[Limitations while using Windows Information Protection (WIP)](limitations-with-wip.md) |The most common problems you might encounter while using Windows Information Protection (WIP). |
+|[Enlightened apps for use with Windows Information Protection (WIP)](enlightened-microsoft-apps-and-wip.md) |Learn the difference between enlightened and unenlightened apps, and then review the list of enlightened apps provided by Microsoft along with the text you will need to use to add them to your allowed apps list. | 
+|[Unenlightened and enlightened app behavior while using Windows Information Protection (WIP)](app-behavior-with-wip.md) |Learn the difference between enlightened and unenlightened app behaviors. |
+|[Recommended Enterprise Cloud Resources and Neutral Resources network settings with Windows Information Protection (WIP)](recommended-network-definitions-for-wip.md) |Recommended additions for the Enterprise Cloud Resources and Neutral Resources network settings, when used with Windows Information Protection (WIP). |
+|[Using Outlook Web Access with Windows Information Protection (WIP)](using-owa-with-wip.md) |Options for using Outlook Web Access (OWA) with Windows Information Protection (WIP). |
 
 >[!NOTE]
->Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to TechNet content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md).
+>Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to TechNet content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md).

windows/keep-secure/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md

@@ -0,0 +1,76 @@
+---
+title: How to use single sign on (SSO) over VPN and Wi-Fi connections (Windows 10)
+description: Explains requirements to enable Single Sign-On (SSO) to on-premises domain resources over WiFi or VPN connections.
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+author: justinha
+---
+
+# How to use single sign on (SSO) over VPN and Wi-Fi connections
+
+This topic explains requirements to enable Single Sign-On (SSO) to on-premises domain resources over WiFi or VPN connections. The scenario is:
+
+- You connect to a network using Wi-Fi or VPN. 
+- You want to use the credentials that you use for the WiFi or VPN authentication to also authenticate requests to access a domain resource you are connecting to, without being prompted for your domain credentials separately. 
+
+For example, you want to connect to a corporate network and access an internal website that requires Windows integrated authentication.
+
+At a high level, the way this works is that the credentials that are used for the connection authentication are put in Credential Manager as the default credentials for the logon session. 
+Credential Manager is a place where credentials in the OS are can be stored for specific domain resources based on the targetname of the resource. 
+For VPN, the VPN stack saves its credential as the session default. 
+For WiFi, EAP does it. 
+
+The credentials are put in Credential Manager as a "`*Session`" credential. 
+A "`*Session`" credential implies that it is valid for the current user session. 
+The credentials are also cleaned up when the WiFi or VPN connection is disconnected. 
+
+When the user tries to access a domain resource, using Edge for example, Edge has the right Enterprise Authentication capability so WinInit.exe can release the credentials that it gets from the Credential Manager to the SSP that is requesting it. 
+For more information about the Enterprise Authentication capability, see [App capability declarations](https://msdn.microsoft.com/windows/uwp/packaging/app-capability-declarations). 
+
+WinInit.exe will look at the device application, such as a Universal Windows Platform (UWP) application, to see if it has the right capability. 
+If the app is not UWP, it does not matter. 
+But if it is a UWP app, it will look at the device capability for Enterprise Authentication. 
+If it does have that capability and if the resource that you are trying to access is in the Intranet zone in the Internet Options (ZoneMap), then the credential will be released. 
+
+## Intranet zone
+
+For the Intranet zone, by default it only allows single-label names, such as Http://finance. 
+If the resource that needs to be accessed has multiple domain labels, then the workaround is to use the [Registry CSP](https://msdn.microsoft.com/library/windows/hardware/dn904964.aspx). 
+
+### Setting the ZoneMap
+
+The ZoneMap is controlled using a registry that can be set through MDM. 
+By default, single-label names such as http://finance are already in the intranet zone. 
+For multi-label names, such as http://finance.net, the ZoneMap needs to be updated.
+
+## MDM Policy
+
+OMA URI example:
+
+./Vendor/MSFT/Registry/HKU/S-1-5-21-2702878673-795188819-444038987-2781/Software/Microsoft/Windows/CurrentVersion/Internet%20Settings/ZoneMap/Domains/`<domain name>`/* as an Integer Value of 1 for each of the domains that you want to SSO into from your device. This adds the specified domains to the Intranet Zone of the Edge browser.
+
+## Credential requirements 
+
+For VPN, the following types of credentials will be added to credential manager after authentication: 
+
+- Username and password
+- Certificate-based authentication:
+    - TPM KSP Certificate
+    - Software KSP Certificates
+    - Smart Card Certificate
+    - Passport for Work Certificate
+
+The username should also include a domain that can be reached over the connection (VPN or WiFi). 
+
+## User certificate templates
+
+If the credentials are certificate-based, then the elements in the following table need to be configured for the certificate templates to ensure they can also be used for Kerberos client authentication.
+
+| TEmplate element | Configuration |
+|------------------|---------------|
+| SubjectName | The user’s distinguished name (DN) where the domain components of the distinguished name reflects the internal DNS namespace when the SubjectAlternativeName does not have the fully qualified UPN required to find the domain controller. </br>This requirement is particularly relevant in multi-forest environments as it ensures a domain controller can be located. |
+| SubjectAlternativeName | The user’s fully qualified UPN where a domain name component of the user’s UPN matches the organizations internal domain’s DNS namespace.</br>This requirement is particularly relevant in multi-forest environments as it ensures a domain controller can be located when the SubjectName does not have the DN required to find the domain controller. |
+| Key Storage Provider (KSP) | If the device is joined to Azure AD, a discrete SSO certificate is used. This certificate must be issued using the PassportForWork CSP. |
+| EnhancedKeyUsage | One or more of the following EKUs is required: </br>- Client Authentication (for the VPN) </br>- EAP Filtering OID (for PassportForWork)</br>- SmartCardLogon (for Azure AD joined devices)</br>If the domain controllers require smart card EKU either:</br>- SmartCardLogon</br>- id-pkinit-KPClientAuth (1.3.6.1.5.2.3.4)</br>Otherwise:</br>- TLS/SSL Client Authentication (1.3.6.1.5.5.7.3.2) |

windows/keep-secure/implement-microsoft-passport-in-your-organization.md

@@ -28,7 +28,7 @@ You can create a Group Policy or mobile device management (MDM) policy that will
  
 ## Group Policy settings for Windows Hello for Business
 
-The following table lists the Group Policy settings that you can configure for Hello use in your workplace. These policy settings are available in both **User configuration** and **Computer Configuration** under **Policies** > **Administrative Templates** > **Windows Components** > **Windows Hello for Business**.
+The following table lists the Group Policy settings that you can configure for Hello use in your workplace. These policy settings are available in both **User configuration** and **Computer Configuration** under **Policies** > **Administrative Templates** > **Windows Components** > **Windows Hello for Business**. Be aware that not all settings are in both places.
 
 
 <table>

windows/keep-secure/index.md

@@ -21,15 +21,21 @@ Learn about keeping Windows 10 and Windows 10 Mobile secure.
 | [Manage identity verification using Windows Hello for Business](hello-manage-identity-verification.md) | In Windows 10, Windows Hello replaces passwords with strong two-factor authentication on PCs and mobile devices. This authentication consists of a new type of user credential that is tied to a device and a biometric or PIN. |
 | [Configure S/MIME for Windows 10 and Windows 10 Mobile](configure-s-mime.md) | In Windows 10, S/MIME lets users encrypt outgoing messages and attachments so that only intended recipients who have a digital identification (ID), also known as a certificate, can read them. Users can digitally sign a message, which provides the recipients with a way to verify the identity of the sender and that the message hasn't been tampered with. |
 | [Install digital certificates on Windows 10 Mobile](installing-digital-certificates-on-windows-10-mobile.md) | Digital certificates bind the identity of a user or computer to a pair of keys that can be used to encrypt and sign digital information. Certificates are issued by a certification authority (CA) that vouches for the identity of the certificate holder, and they enable secure client communications with websites and services. |
-| [Protect derived domain credentials with Credential Guard](credential-guard.md) | Introduced in Windows 10 Enterprise, Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. Unauthorized access to these secrets can lead to credential theft attacks, such as Pass-the-Hash or Pass-The-Ticket. Credential Guard prevents these attacks by protecting NTLM password hashes and Kerberos Ticket Granting Tickets. |
+| [Device Guard deployment guide](device-guard-deployment-guide.md) | Device Guard is a combination of hardware and software security features that, when configured together, will lock a device down so that it can only run trusted applications. If the app isn’t trusted it can’t run, period. It also means that even if an attacker manages to get control of the Windows kernel, he or she will be much less likely to be able to run malicious executable code after the computer restarts because of how decisions are made about what can run and when. |
+| [Protect derived domain credentials with Credential Guard](credential-guard.md) | Introduced in Windows 10 Enterprise, Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. Unauthorized access to these secrets can lead to credential theft attacks, such as Pass-the-Hash or Pass-The-Ticket. Credential Guard helps prevent these attacks by protecting NTLM password hashes and Kerberos Ticket Granting Tickets. |
 | [Protect Remote Desktop credentials with Remote Credential Guard](remote-credential-guard.md) | Remote Credential Guard helps you protect your credentials over a Remote Desktop connection by redirecting the Kerberos requests back to the device that's requesting the connection. |
-| [Protect your enterprise data using Windows Information Protection (WIP)](protect-enterprise-data-using-wip.md) | With the increase of employee-owned devices in the enterprise, there’s also an increasing risk of accidental data leak through apps and services, like email, social media, and the public cloud, which are outside of the enterprise’s control. For example, when an employee sends the latest engineering pictures from their personal email account, copies and pastes product info into a tweet, or saves an in-progress sales report to their public cloud storage. |
+| [Protect your enterprise data using Windows Information Protection (WIP)](protect-enterprise-data-using-wip.md) | With the increase of employee-owned devices in the enterprise, there’s also an increasing risk of accidental data leak through apps and services, like email, social media, and the public cloud, which are outside of the enterprise’s control. Windows Information Protection (WIP), previously known as enterprise data protection (EDP), helps to protect against this potential data leakage without otherwise interfering with the employee experience. |
 | [Use Windows Event Forwarding to help with intrusion detection](use-windows-event-forwarding-to-assist-in-instrusion-detection.md) | Learn about an approach to collect events from devices in your organization. This article talks about events in both normal operations and when an intrusion is suspected. |
 |[Override Process Mitigation Options to help enforce app-related security policies](override-mitigation-options-for-app-related-security-policies.md) |Use Group Policy to override individual **Process Mitigation Options** settings and help to enforce specific app-related security policies. |
 | [VPN technical guide](vpn-guide.md) | Virtual private networks (VPN) let you give your users secure remote access to your company network. Windows 10 adds useful new VPN profile options to help you manage how users connect. |
 | [Windows security baselines](windows-security-baselines.md) | Learn why you should use security baselines in your organization. |
+<<<<<<< HEAD
 | [Security technologies](security-technologies.md) | Learn more about the different security technologies that are available in Windows 10 and Windows 10 Mobile. |
 | [Enterprise security guides](windows-10-enterprise-security-guides.md) | Get proven guidance to help you better secure and protect your enterprise by using technologies such as Credential Guard and Device Guard. This section offers technology overviews and step-by-step guides. |
+=======
+| [Security technologies](security-technologies.md) | Learn more about the different security technologies that are available in Windows 10 and Windows 10 Mobile. For example, learn about AppLocker, BitLocker, and Security auditing. |
+| [Enterprise security guides](windows-10-enterprise-security-guides.md) | Review technology overviews that help you understand Windows 10 security technologies in the context of the enterprise. |
+>>>>>>> refs/remotes/origin/master
 | [Change history for Keep Windows 10 secure](change-history-for-keep-windows-10-secure.md) | This topic lists new and updated topics in the Keep Windows 10 secure documentation for [Windows 10 and Windows 10 Mobile](../index.md). |
  
 ## Related topics

windows/keep-secure/initialize-and-configure-ownership-of-the-tpm.md

@@ -1,6 +1,6 @@
 ---
-title: Initialize and configure ownership of the TPM (Windows 10)
-description: This topic for the IT professional describes how to initialize and set the ownership the Trusted Platform Module (TPM), turn the TPM on and off, and clear TPM keys.
+title: View status, clear, or troubleshoot the TPM (Windows 10)
+description: This topic for the IT professional describes how to view status for, clear, or troubleshoot the Trusted Platform Module (TPM).
 ms.assetid: 1166efaf-7aa3-4420-9279-435d9c6ac6f8
 ms.prod: w10
 ms.mktglfcycl: deploy
@@ -9,156 +9,146 @@ ms.pagetype: security
 author: brianlic-msft
 ---
 
-# Initialize and configure ownership of the TPM
+# View status, clear, or troubleshoot the TPM
 
 **Applies to**
 -   Windows 10
+-   Windows Server 2016
 
-This topic for the IT professional describes how to initialize and set the ownership the Trusted Platform Module (TPM), turn the TPM on and off, and clear TPM keys. It also explains how to troubleshoot issues that you might encounter as a result of using these procedures.
+This topic for the IT professional describes actions you can take through the Trusted Platform Module (TPM) snap-in, **TPM.msc**:
 
-## <a href="" id="bkmk-init"></a>About TPM initialization and ownership
+-   [View the status of the TPM](#view-the-status-of-the-tpm)
 
-The TPM must be initialized and ownership must be taken before it can be used to help secure your computer. The owner of the TPM is the user who possesses the owner password and is able to set it and change it. Only one owner password exists per TPM. The owner of the TPM can make full use of TPM capabilities. Taking ownership of the TPM can be done as part of the initialization process.
+-   [Troubleshoot TPM initialization](#troubleshoot-tpm-initialization)
 
-When you start the TPM Initialization Wizard, which is accessed through the TPM Microsoft Management Console (MMC), you can determine whether the computer's TPM has been initialized. You can also view the TPM properties.
+-   [Clear all the keys from the TPM](#clear-all-the-keys-from-the-tpm)
 
-This topic contains procedures for the following tasks:
+With TPM 1.2 and Windows 10, version 1507 or 1511, you can also take the following actions:
 
--   [Initialize the TPM and set ownership](#bkmk-initializetpm)
--   [Troubleshoot TPM initialization](#bkmk-troubleshootinit)
--   [Turn on or turn off the TPM](#bkmk-onoff)
--   [Clear all the keys from the TPM](#bkmk-clear1)
--   [Use the TPM cmdlets](#bkmk-tpmcmdlets)
+-   [Turn on or turn off the TPM](#turn-on-or-turn-off)
 
-## <a href="" id="bkmk-initializetpm"></a>Initialize the TPM and set ownership
+This topic also provides information about [using the TPM cmdlets](#use-the-tpm-cmdlets).
 
-Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure. In addition, the computer must be equipped with a Trusted Computing Group-compliant BIOS.
+## About TPM initialization and ownership
 
-**To start the TPM Initialization Wizard**
+Starting with Windows 10, the operating system automatically initializes and takes ownership of the TPM. This is a change from previous operating systems, where you would initialize the TPM and create an owner password. Therefore, with Windows 10, in most cases, we recommend that you avoid configuring the TPM through **TPM.msc**. The one exception is that in certain circumstances you might use **TPM.msc** to clear the TPM. For more information, see [Clear all the keys from the TPM](#clear-all-the-keys-from-the-tpm), later in this topic.
 
-1.  Open the TPM Management console (tpm.msc). If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then click **Yes**.
-2.  On the **Action** menu, click **Initialize TPM** to start the TPM Initialization Wizard.
-3.  If the TPM has never been initialized or is turned off, the TPM Initialization Wizard displays the **Turn on the TPM security hardware** dialog box. This dialog box provides guidance for initializing or turning on the TPM. Follow the instructions in the wizard.
+## View the status of the TPM
 
-    >**Note:**  If the TPM is already turned on, the TPM Initialization Wizard displays the **Create the TPM owner password** dialog box. Skip the remainder of this procedure and continue with the **To set ownership of the TPM** procedure.
-     
-    >**Note:**  If the TPM Initialization Wizard detects that you do not have a compatible BIOS, you cannot continue with the TPM Initialization Wizard, and you are alerted to consult the computer manufacturer's documentation for instructions to initialize the TPM.
-     
-4.  Click **Restart**.
-5.  Follow the BIOS screen prompts. An acceptance prompt is displayed to ensure that a user has physical access to the computer and that no malicious software is attempting to turn on the TPM.
-    
-    >**Note:**  BIOS screen prompts and the required keystrokes vary by computer manufacturer.
-     
-6.  After the computer restarts, sign in to the computer with the same administrative credentials that you used to start this procedure.
-7.  The TPM Initialization Wizard automatically restarts. If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then click **Yes**.
-8.  Continue with the next procedure to take ownership of the TPM.
+To view the status of the TPM, open the TPM Management console (TPM.msc). In the center pane, find the **Status** box.
 
-To finish initializing the TPM for use, you must set an owner for the TPM. The process of taking ownership includes creating an owner password for the TPM.
+In most cases, the status will be **Ready**. If the status is ready but “**with reduced functionality**,” see [Clear all the keys from the TPM](#clear-all-the-keys-from-the-tpm), later in this topic.
 
-**To set ownership of the TPM**
+If the status is **Not ready**, you can try the steps in [Clear all the keys from the TPM](#clear-all-the-keys-from-the-tpm), later in this topic. If this does not bring it to a **Ready** state, contact the manufacturer, and see the troubleshooting suggestions in the next section.
 
-1.  If you are not continuing immediately from the last procedure, start the TPM Initialization Wizard. If you need to review the steps to do so, see the previous procedure **To start the TPM Initialization Wizard**.
-2.  In the **Create the TPM owner password** dialog box, click **Automatically create the password (recommended)**.
-3.  In the **Save your TPM owner password** dialog box, click **Save the password**.
-4.  In the **Save As** dialog box, select a location to save the password, and then click **Save**. The password file is saved as *computer\_name.tpm*.
+## Troubleshoot TPM initialization
 
-    >**Important:**  We highly recommend saving the TPM owner password to a removable storage device and storing it in a safe location.
-     
-5.  Click **Print the password** if you want to print a copy of your password.
-    >**Important:**  We highly recommend printing a copy of your TPM owner password and storing it in a safe location.
-     
-6.  Click **Initialize**.
-    >**Note:**  The process of initializing the TPM might take a few minutes to complete.
-     
-7.  Click **Close**.
-    >**Caution:**  Do not lose your password. If you do, you will be unable to make administrative changes unless you clear the TPM, which can result in data loss.
-     
-## <a href="" id="bkmk-troubleshootinit"></a>Troubleshoot TPM initialization
+If you find that Windows is not able to initialize the TPM automatically, review the following information:
 
-Managing the Trusted Platform Module (TPM) is usually a straightforward procedure. If are unable to complete the initialization procedure, review the following information:
+-   You can try clearing the TPM to the factory default values and allowing Windows to re-initialize it. For important precautions for this process, and instructions for completing it, see [Clear all the keys from the TPM](#clear-all-the-keys-from-the-tpm), later in this topic.
 
--   If the TPM is not detected by Windows, verify that your computer hardware contains a Trusted Computing Group-compliant BIOS. Ensure that no BIOS settings have been used to hide the TPM from the operating system.
--   If you are attempting to initialize the TPM as part of the BitLocker setup, check which TPM driver is installed on the computer. We recommend always using one of the TPM drivers that is provided by Microsoft and is protected with BitLocker. If a non-Microsoft TPM driver is installed, it may prevent the default TPM driver from loading and cause BitLocker to report that a TPM is not present on the computer. If you have a non-Microsoft driver installed, remove it and then try to initialize the TPM. The following table lists the three standard TPM drivers that are provided by Microsoft.
+-   If the TPM is a TPM 2.0 and is not detected by Windows, verify that your computer hardware contains a Unified Extensible Firmware Interface (UEFI) that is Trusted Computing Group-compliant. Also, ensure that in the UEFI settings, the TPM has not been disabled or hidden from the operating system.
 
-| Driver name | Manufacturer |
-| - | - |
-| Trusted Platform Module 1.2 | (Standard)| 
-| Broadcom Trusted Platform Module (A1), v1.2 | Broadcom| 
-| Broadcom Trusted Platform Module (A2), v1.2 | Broadcom| 
-     
--   If the TPM has been previously initialized and you do not have the owner password, you may have to clear or reset the TPM to the factory default values. For more information, see [Clear all the keys from the TPM](#bkmk-clear1).
-    > **Caution:**  Clearing the TPM can result in data loss. To avoid data loss, make sure that you have a backup or recovery method for any data that is protected or encrypted by the TPM.
-     
-Because your TPM security hardware is a physical part of your computer, you may want to read the manuals or instructions that came with your computer, or search the manufacturer's website.
+-   If you have TPM 1.2 with Windows 10, version 1507 or 1511, the TPM might be turned off, and need to be turned back on, as described in [Turn on the TPM](#turn-on-the-tpm). When it is turned back on, Windows will re-initialize it.
 
-**Network connection**
+-   If you are attempting to set up BitLocker with the TPM, check which TPM driver is installed on the computer. We recommend always using one of the TPM drivers that is provided by Microsoft and is protected with BitLocker. If a non-Microsoft TPM driver is installed, it may prevent the default TPM driver from loading and cause BitLocker to report that a TPM is not present on the computer. If you have a non-Microsoft driver installed, remove it and then allow the operating system to initialize the TPM.
 
-You cannot complete the initialization of the Trusted Platform Module (TPM) when your computer is disconnected from your organization's network if either of the following conditions exist:
+### Troubleshoot network connection issues for Windows 10, versions 1507 and 1511
+
+If you have Windows 10, version 1507 or 1511, the initialization of the TPM cannot complete when your computer has network connection issues and both of the following conditions exist:
 
 -   An administrator has configured your computer to require that TPM recovery information be saved in Active Directory Domain Services (AD DS). This requirement can be configured through Group Policy.
+
 -   A domain controller cannot be reached. This can occur on a computer that is currently disconnected from the network, separated from the domain by a firewall, or experiencing a network component failure (such as an unplugged cable or a faulty network adapter).
 
-In either case, an error message appears, and you cannot complete the initialization process. To avoid this issue, initialize the TPM while you are connected to the corporate network and you can contact a domain controller.
+If these issues occur, an error message appears, and you cannot complete the initialization process. To avoid this issue, allow Windows to initialize the TPM while you are connected to the corporate network and you can contact a domain controller.
 
-**Systems with multiple TPMs**
+### Troubleshoot systems with multiple TPMs
 
-Some systems may have multiple TPMs and the active TPM may be toggled in the BIOS. Windows 10 does not support this behavior. If you switch TPMs, functionality that depends on the TPM will not work with the new TPM unless it is cleared and put through provisioning. Performing this clear may cause data loss, in particular of keys and certificates associated with the previous TPM. For example, toggling TPMs will cause Bitlocker to enter recovery mode. It is strongly recommended that, on systems with two TPMs, one TPM is selected to be used and the selection is not changed.
+Some systems may have multiple TPMs and the active TPM may be toggled in UEFI. Windows 10 does not support this behavior. If you switch TPMs, Windows might not properly detect or interact with the new TPM. If you plan to switch TPMs you should toggle to the new TPM, clear it, and reinstall Windows. For more information, see [Clear all the keys from the TPM](#clear-all-the-keys-from-the-tpm), later in this topic.
 
-## <a href="" id="bkmk-onoff"></a>Turn on or turn off the TPM
+For example, toggling TPMs will cause BitLocker to enter recovery mode. We strongly recommend that, on systems with two TPMs, one TPM is selected to be used and the selection is not changed.
 
-Normally, the TPM is turned on as part of the TPM initialization process. You do not normally need to turn the TPM on or off. However, if necessary you can do so by using the TPM MMC. This option is only available with TPM 1.2 and does not apply to TPM 2.0.
+## Clear all the keys from the TPM
 
-### <a href="" id="turn-on-the-tpm-"></a>Turn on the TPM
+With Windows 10, in most cases, we recommend that you avoid configuring the TPM through TPM.msc. The one exception is that you can use TPM.msc to clear the TPM, for example, as a troubleshooting step, or as a final preparation before a clean installation of a new operating system. Preparing for a clean installation in this way helps ensure that the new operating system can fully deploy any TPM-based functionality that it includes, for example, attestation. However, even if the TPM is not cleared before a new operating system is installed, most TPM functionality will probably work correctly.
 
-If the TPM has been initialized but has never been used, or if you want to use the TPM after you have turned it off, you can use the following procedure to turn on the TPM.
+Clearing the TPM resets it to an unowned state. After you clear the TPM, the Windows 10 operating system will automatically re-initialize it and take ownership again.
 
-**To turn on the TPM (TPM 1.2 Only)**
+> [!WARNING]
+> Clearing the TPM can result in data loss. For more information, see the next section, “Precautions to take before clearing the TPM.”
 
-1.  Open the TPM MMC (tpm.msc).
-2.  In the **Action** pane, click **Turn TPM On** to display the **Turn on the TPM Security Hardware** page. Read the instructions on this page.
-3.  Click **Shutdown** (or **Restart**), and then follow the BIOS screen prompts.
+There are several ways to clear the TPM:
 
-    After the computer restarts, but before you sign in to Windows, you will be prompted to accept the reconfiguration of the TPM. This ensures that the user has physical access to the computer and that malicious software is not attempting to make changes to the TPM.
+-   **Clear the TPM as part of a complete reset of the computer**: You might want to remove all files from the computer and completely reset it, for example, in preparation for a clean installation. To do this, we recommend that you use the **Reset** option in **Settings**. When you perform a reset and use the **Remove everything** option, it will clear the TPM as part of the reset. You might be prompted to press a key before the TPM can be cleared. For more information, see the “Reset this PC” section in [Recovery options in Windows 10](https://support.microsoft.com/en-us/help/12415/windows-10-recovery-options).
 
-### <a href="" id="turn-off-the-tpm-"></a>Turn off the TPM
+-   **Clear the TPM to fix “reduced functionality” or “Not ready” TPM status**: If you open TPM.msc and see that the TPM status is something other than **Ready**, you can can try using TPM.msc to clear the TPM and fix the status. However, be sure to review the precautions in the next section.
 
-If you want to stop using the services that are provided by the TPM, you can use the TPM MMC to turn off the TPM. If you have the TPM owner password, physical access to the computer is not required to turn off the TPM. If you do not have the TPM owner password, you must have physical access to the 
-computer to turn off the TPM.
+### Precautions to take before clearing the TPM
 
-**To turn off the TPM (TPM 1.2 only)**
+Clearing the TPM can result in data loss. To protect against such loss, review the following precautions:
 
-1.  Open the TPM MMC (tpm.msc).
-2.  In the **Action** pane, click **Turn TPM Off** to display the **Turn off the TPM security hardware** page.
-3.  In the **Turn off the TPM security hardware** dialog box, select a method to enter your owner password and turning off the TPM:
+-   Clearing the TPM causes you to lose all created keys associated with the TPM, and data protected by those keys, such as a virtual smart card or a login PIN. Make sure that you have a backup and recovery method for any data that is protected or encrypted by the TPM.
 
-    -   If you saved your TPM owner password on a removable storage device, insert it, and then click **I have the owner password file**. In the **Select backup file with the TPM owner password** dialog box, click **Browse** to locate the .tpm file that is saved on your removable storage device, click **Open**, and then click **Turn TPM Off**.
-    -   If you do not have the removable storage device with your saved TPM owner password, click **I want to enter the password**. In the **Type your TPM owner password** dialog box, type your password (including hyphens), and then click **Turn TPM Off**.
-    -   If you do not know your TPM owner password, click **I do not have the TPM owner password**, and follow the instructions that are provided in the dialog box and subsequent BIOS screens to turn off the TPM without entering the password.
+-   Do not clear the TPM on a device you do not own, such as a work or school PC, without being instructed to do so by your IT administrator.
 
-## <a href="" id="bkmk-clear1"></a>Clear all the keys from the TPM
+-   If you want to temporarily suspend TPM operations and you have TPM 1.2 with Windows 10, version 1507 or 1511, you can turn off the TPM. For more information, see [Turn off the TPM](#turn-off-the-tpm), later in this topic.
 
-Clearing the TPM resets it to an unowned state. After clearing the TPM, you need to complete the TPM initialization process before using software that relies on the TPM, such as BitLocker Drive Encryption. By default, the TPM is initialized automatically.
+-   Always use functionality in the operating system (such as TPM.msc) to the clear the TPM. Do not clear the TPM directly from UEFI.
 
->**Important:**  Clearing the TPM can result in data loss. To avoid data loss, make sure that you have a backup or recovery method for any data that is protected or encrypted by the TPM.
- 
-After the TPM is cleared, it is also turned off.
-
-To temporarily suspend TPM operations, turn off the TPM instead of clearing it.
+-   Because your TPM security hardware is a physical part of your computer, before clearing the TPM, you might want to read the manuals or instructions that came with your computer, or search the manufacturer's website.
 
 Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.
 
 **To clear the TPM**
 
 1.  Open the TPM MMC (tpm.msc).
-2.  If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then click **Yes**.
-3.  Under **Actions**, click **Clear TPM**.
-    >**Warning:**  If the TPM is off, reinitialize it before clearing it.
-    
-    Clearing the TPM resets it to factory defaults and turns it off. You will lose all created keys and data that is protected by those keys.
-     
-4.  You will be prompted to restart the computer. During the restart, you will be prompted by the BIOS or UEFI to press a button to confirm you wish to clear the TPM.
 
-## <a href="" id="bkmk-tpmcmdlets"></a>Use the TPM cmdlets
+2.  If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then click **Yes**.
+
+3.  Under **Actions**, click **Clear TPM**.
+
+4.  You will be prompted to restart the computer. During the restart, you might be prompted by the UEFI to press a button to confirm that you wish to clear the TPM.
+
+5.  After the PC restarts, your TPM will be automatically prepared for use by Windows 10.
+
+## <a href="" id="turn-on-or-turn-off"></a>Turn on or turn off the TPM (TPM 1.2 with Windows 10, version 1507 or 1511)
+
+Normally, the TPM is turned on as part of the TPM initialization process. You do not normally need to turn the TPM on or off. However, if necessary you can do so by using the TPM MMC.
+
+### Turn on the TPM
+
+If you want to use the TPM after you have turned it off, you can use the following procedure to turn on the TPM.
+
+**To turn on the TPM (TPM 1.2 with Windows 10, version 1507 or 1511 only)**
+
+1.  Open the TPM MMC (tpm.msc).
+
+2.  In the **Action** pane, click **Turn TPM On** to display the **Turn on the TPM Security Hardware** page. Read the instructions on this page.
+
+3.  Click **Shutdown** (or **Restart**), and then follow the UEFI screen prompts.
+
+    After the computer restarts, but before you sign in to Windows, you will be prompted to accept the reconfiguration of the TPM. This ensures that the user has physical access to the computer and that malicious software is not attempting to make changes to the TPM.
+
+### Turn off the TPM
+
+If you want to stop using the services that are provided by the TPM, you can use the TPM MMC to turn off the TPM.
+
+**To turn off the TPM (TPM 1.2 with Windows 10, version 1507 or 1511 only)**
+
+1.  Open the TPM MMC (tpm.msc).
+
+2.  In the **Action** pane, click **Turn TPM Off** to display the **Turn off the TPM security hardware** page.
+
+3.  In the **Turn off the TPM security hardware** dialog box, select a method to enter your owner password and turning off the TPM:
+
+  -   If you saved your TPM owner password on a removable storage device, insert it, and then click **I have the owner password file**. In the **Select backup file with the TPM owner password** dialog box, click **Browse** to locate the .tpm file that is saved on your removable storage device, click **Open**, and then click **Turn TPM Off**.
+
+  -   If you do not have the removable storage device with your saved TPM owner password, click **I want to enter the password**. In the **Type your TPM owner password** dialog box, type your password (including hyphens), and then click **Turn TPM Off**.
+
+  -   If you did not save your TPM owner password or no longer know it, click **I do not have the TPM owner password**, and follow the instructions that are provided in the dialog box and subsequent UEFI screens to turn off the TPM without entering the password.
+
+## Use the TPM cmdlets
 
 If you are using Windows PowerShell to manage your computers, you can also manage the TPM by using Windows PowerShell. To install the TPM cmdlets, type the following command:
 
@@ -166,6 +156,6 @@ If you are using Windows PowerShell to manage your computers, you can also manag
 
 For details about the individual cmdlets, see [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx).
 
-## Additional resources
+## Related topics
 
-For more info about TPM, see [Trusted Platform Module Technology Overview](trusted-platform-module-overview.md#bkmk-additionalresources).
+- [Trusted Platform Module](trusted-platform-module-top-node.md) (list of topics)

windows/keep-secure/installing-digital-certificates-on-windows-10-mobile.md

@@ -24,8 +24,8 @@ Certificates in Windows 10 Mobile are primarily used for the following purposes
 -   For installation and licensing of applications (from the Windows Phone Store or a custom company distribution site).
 
 
-**Warning**  
-In Windows 10, Version 1607, if you have multiple certificates provisioned on the device and the Wi-Fi profile provisioned does not have a strict filtering criteria, you may see connection failures when connecting to Wi-Fi. [Learn more about this known issue in Version 1607](https://go.microsoft.com/fwlink/p/?LinkId=786764)
+>[!WARNING]  
+>In Windows 10, Version 1607, if you have multiple certificates provisioned on the device and the Wi-Fi profile provisioned does not have a strict filtering criteria, you may see connection failures when connecting to Wi-Fi. [Learn more about this known issue in Version 1607](https://go.microsoft.com/fwlink/p/?LinkId=786764)
 
 ## Install certificates using Microsoft Edge
 
@@ -33,12 +33,13 @@ A certificate can be posted on a website and made available to users through a d
 
 ## Install certificates using email
 
-The Windows 10 Mobile certificate installer supports .cer, .p7b, .pem, and .pfx files. To install certificates via email, make sure your mail filters do not block .cer files. Certificates that are sent via email appear as message attachments. When a certificate is received, a user can tap to review the contents and then tap to install the certificate. Typically, when an identity certificate is installed, the user is prompted for the password (or passphrase) that protects it.
+The Windows 10 Mobile certificate installer supports .cer, .p7b, .pem, and .pfx files. Some email programs block .cer files for security reasons. If this is the case in your organization, use an alternative method to deploy the certificate. Certificates that are sent via email appear as message attachments. When a certificate is received, a user can tap to review the contents and then tap to install the certificate. Typically, when an identity certificate is installed, the user is prompted for the password (or passphrase) that protects it.
 
 ## Install certificates using mobile device management (MDM)
 
 Windows 10 Mobile supports root, CA, and client certificate to be configured via MDM. Using MDM, an administrator can directly add, delete, or query root and CA certificates, and configure the device to enroll a client certificate with a certificate enrollment server that supports Simple Certificate Enrollment Protocol (SCEP). SCEP enrolled client certificates are used by Wi-Fi, VPN, email, and browser for certificate-based client authentication. An MDM server can also query and delete SCEP enrolled client certificate (including user installed certificates), or trigger a new enrollment request before the current certificate is expired.
-> **Warning:**  Do not use SCEP for encryption certificates for S/MIME. You must use a PFX certificate profile to support S/MIME on Windows 10 Mobile. For instructions on creating a PFX certificate profile in Microsoft Intune, see [Enable access to company resources using certificate profiles with Microsoft Intune](https://go.microsoft.com/fwlink/p/?LinkID=718216).
+>[!WARNING]
+>Do not use SCEP for encryption certificates for S/MIME. You must use a PFX certificate profile to support S/MIME on Windows 10 Mobile. For instructions on creating a PFX certificate profile in Microsoft Intune, see [Enable access to company resources using certificate profiles with Microsoft Intune](https://go.microsoft.com/fwlink/p/?LinkID=718216).
  
 **Process of installing certificates using MDM**
 
@@ -50,14 +51,17 @@ Windows 10 Mobile supports root, CA, and client certificate to be configured vi
 6.  The device connects to Internet-facing point exposed by MDM server.
 7.  MDM server creates a certificate that is signed with proper CA certificate and returns it to device.
 
-    > **Note:**  The device supports the pending function to allow server side to do additional verification before issuing the cert. In this case, a pending status is sent back to the device. The device will periodically contact the server, based on preconfigured retry count and retry period parameters. Retrying ends when either:
-    A certificate is successfully received from the server
-    The server returns an error
-    The number of retries reaches the preconfigured limit
+    >[!NOTE]
+    >The device supports the pending function to allow server side to do additional verification before issuing the cert. In this case, a pending status is sent back to the device. The device will periodically contact the server, based on preconfigured retry count and retry period parameters. Retrying ends when either:
+    >
+    >- A certificate is successfully received from the server
+    >- The server returns an error
+    >- The number of retries reaches the preconfigured limit
      
 8.  The cert is installed in the device. Browser, Wi-Fi, VPN, email, and other first party applications have access to this certificate.
 
-    > **Note:**  If MDM requested private key being stored in Trusted Process Module (TPM) (configured during enrollment request), the private key will be saved in TPM. Note that SCEP enrolled cert protected by TPM isn’t guarded by a PIN. However, if the certificate is imported to the Passport for Work Key Storage Provider (KSP), it is guarded by the Passport PIN.
+    >[!NOTE]
+    >If MDM requested private key stored in Trusted Process Module (TPM) (configured during enrollment request), the private key will be saved in TPM. Note that SCEP enrolled cert protected by TPM isn’t guarded by a PIN. However, if the certificate is imported to the Windows Hello for Business Key Storage Provider (KSP), it is guarded by the Hello PIN.
      
 ## Related topics
 

windows/keep-secure/interactive-logon-display-user-information-when-the-session-is-locked.md

@@ -35,7 +35,7 @@ When a session is locked in a Windows operating system (meaning the user at the
 
 -   Blank.
 
-    Default setting. This translates to “Not defined,” but it will display the user’s full name in the same manner as the **User display name, domain and user names** option. When an option is set, you cannot reset this policy to blank, or not defined.
+    Default setting. This translates to “Not defined,” but it will display the user’s full name in the same manner as the **User display name** option. When an option is set, you cannot reset this policy to blank, or not defined.
 
 ### Best practices
 

windows/keep-secure/interactive-logon-do-not-display-last-user-name.md

@@ -34,8 +34,6 @@ If this policy is disabled, the full name of the last user to log on is displaye
 
 Your implementation of this policy depends on your security requirements for displayed logon information. If you have devices that store sensitive data, with monitors displayed in unsecured locations, or if you have devices with sensitive data that are remotely accessed, revealing logged on user’s full names or domain account names might contradict your overall security policy.
 
-Depending on your security policy, you might also want to enable the [Interactive logon: Display user information when the session is locked](interactive-logon-display-user-information-when-the-session-is-locked.md) policy, which will prevent the Windows operating system from displaying the logon name when the session is locked or started.
-
 ### Location
 
 Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options

windows/keep-secure/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md

@@ -75,5 +75,5 @@ Another Windows 10 feature that employs VBS is [Credential Guard](credential-gua
 
 Credential Guard is targeted at resisting pass-the-hash and pass-the-ticket techniques. By employing multifactor authentication with Credential Guard, organizations can gain additional protection against such threats. 
 
-In addition to the client-side enabling of Credential Guard, organizations can deploy mitigations at both the CA and domain controller level to help prevent credential theft. For more information, see the [Additional mitigations](https://technet.microsoft.com/en-us/itpro/windows/keep-secure/credential-guard#additional-mitigations) section in “Protect derived domain credentials with Credential Guard.”
+
 

windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md

@@ -21,12 +21,12 @@ localizationpriority: high
 - Windows 10 Pro Education
 - Windows Defender Advanced Threat Protection (Windows Defender ATP)
 
-The **Machines view** shows a list of the machines in your network, the corresponding number of active alerts for each machine categorized by alert severity levels, and the number of active malware detections. This view allows you to identify machines with the highest risk at a glance, and keep track of all the machines that are reporting telemetry in your network.
+The **Machines view** shows a list of the machines in your network, the corresponding number of active alerts for each machine categorized by alert severity levels, and the number of active malware detections. This view allows you to identify machines with the highest risk at a glance, and keep track of all the machines that are reporting sensor data in your network.
 
 Use the Machines view in these two main scenarios:
 
 - **During onboarding**
-  - During the onboarding process, the Machines view gradually gets populated with endpoints as they begin to report telemetry. Use this view to track your onboarded endpoints as they appear. Use the available features to sort and filer to see which endpoints have most recently reported telemetry, or download the complete endpoint list as a CSV file for offline analysis.
+  - During the onboarding process, the Machines view gradually gets populated with endpoints as they begin to report sensor data. Use this view to track your onboarded endpoints as they appear. Use the available features to sort and filer to see which endpoints have most recently reported sensor data, or download the complete endpoint list as a CSV file for offline analysis.
 - **Day-to-day work**
   - The **Machines view** enables you to identify machines that are most at risk in a glance. High-risk machines are those with the greatest number and highest-severity alerts. By sorting the machines by risk, you'll be able to identify the most vulnerable machines and take action on them.
 
@@ -34,7 +34,7 @@ The Machines view contains the following columns:
 
 - **Machine name** - the name or GUID of the machine
 - **Domain** - the domain the machine belongs to
-- **Last seen** - when the machine last reported telemetry
+- **Last seen** - when the machine last reported sensor data
 - **Internal IP** - the local internal Internet Protocol (IP) address of the machine
 - **Active Alerts** - the number of alerts reported by the machine by severity
 - **Active malware detections** - the number of active malware detections reported by the machine
@@ -59,7 +59,7 @@ You can filter the view by the following time periods:
 - 6 months
 
 > [!NOTE]
-> When you select a time period, the list will only display machines that reported within the selected time period. For example, selecting 1 day will only display a list of machines that reported telemetry within the last 24-hour period.
+> When you select a time period, the list will only display machines that reported within the selected time period. For example, selecting 1 day will only display a list of machines that reported sensor data within the last 24-hour period.
 
 The threat category filter lets you filter the view by the following categories:
 
@@ -94,7 +94,7 @@ When you investigate a specific machine, you'll see:
 - **Alerts related to this machine**
 - **Machine timeline**
 
-The machine details, IP, and reporting sections display some attributes of the machine such as its name, domain, OS, IP address, and how long it's been reporting telemetry to the Windows Defender ATP service.
+The machine details, IP, and reporting sections display some attributes of the machine such as its name, domain, OS, IP address, and how long it's been reporting sensor data to the Windows Defender ATP service.
 
 The **Alerts related to this machine** section provides a list of alerts that are associated with the machine. This list is a simplified version of the [Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md), and shows the date that the alert was detected, a short description of the alert, the alert's severity, the alert's threat category, and the alert's status in the queue.
 

windows/keep-secure/limitations-with-wip.md

@@ -25,8 +25,8 @@ This table provides info about the most common problems you might encounter whil
         <th>Workaround</th>
     </tr>
     <tr>
-        <td>Enterprise data on USB drives is tied to the device it was protected on.</td>
-        <td>Data in the new location remains encrypted, but becomes inaccessible on other devices and for other users. For example, the file won't open or the file opens, but doesn't contain readable text.</td>
+        <td>Your enterprise data on USB drives might be tied to the device it was protected on, based on your Azure RMS configuration.</td>
+        <td><strong>If you’re using Azure RMS:</strong> Authenticated users can open enterprise data on USB drives, on computers running the latest build from the Windows Insider Program.<p><strong>If you’re not using Azure RMS:</strong> Data in the new location remains encrypted, but becomes inaccessible on other devices and for other users. For example, the file won't open or the file opens, but doesn't contain readable text.</td>
         <td>Share files with fellow employees through enterprise file servers or enterprise cloud locations. If data must be shared via USB, employees can decrypt protected files, but it will be audited.<p>We strongly recommend educating employees about how to limit or eliminate the need for this decryption.</td>
     </tr>
     <tr>
@@ -67,7 +67,7 @@ This table provides info about the most common problems you might encounter whil
     <tr>
         <td>Redirected folders with Client Side Caching are not compatible with WIP.</td>
         <td>Apps might encounter access errors while attempting to read a cached, offline file.</td>
-        <td>Migrate to use another file synchronization method, such as Work Folders or OneDrive for Business.</td>
+        <td>Migrate to use another file synchronization method, such as Work Folders or OneDrive for Business.<p><strong>Note</strong><br>For more info about Work Folders and Offline Files, see the blog, [Work Folders and Offline Files support for Windows Information Protection](https://blogs.technet.microsoft.com/filecab/2016/08/29/work-folders-and-offline-files-support-for-windows-information-protection/). If you're having trouble opening files offline while using Offline Files and WIP, see the support article, [Can't open files offline when you use Offline Files and Windows Information Protection](https://support.microsoft.com/en-us/kb/3187045).</td>
     </tr>
     <tr>
         <td>You can't upload an enterprise file to a personal location using Microsoft Edge or Internet Explorer.</td>

windows/keep-secure/maintain-applocker-policies.md

@@ -47,7 +47,7 @@ Before modifying a policy, evaluate how the policy is currently implemented. For
 
 ### Step 2: Export the AppLocker policy from the GPO
 
-Updating an AppLocker policy that is currently enforced in your production environment can have unintended results. Therefore, export the policy from the GPO and update the rule or rules by using AppLocker on your AppLocker reference or test computer. To prepare an AppLocker policy for modification, see [Export an AppLocker policy from a GPO](export-an-applocker-policy-from-a-gpo.md)
+Updating an AppLocker policy that is currently enforced in your production environment can have unintended results. Therefore, export the policy from the GPO and update the rule or rules by using AppLocker on your AppLocker reference or test computer. To prepare an AppLocker policy for modification, see [Export an AppLocker policy from a GPO](export-an-applocker-policy-from-a-gpo.md).
 
 ### Step 3: Update the AppLocker policy by editing the appropriate AppLocker rule
 

windows/keep-secure/manage-identity-verification-using-microsoft-passport.md

@@ -102,7 +102,7 @@ When identity providers such as Active Directory or Azure AD enroll a certificat
 
 [Introduction to Windows Hello](https://go.microsoft.com/fwlink/p/?LinkId=786649), video presentation on Microsoft Virtual Academy
 
-[What's new in Active Directory Domain Services (AD DS) in Windows Server Technical Preview](https://go.microsoft.com/fwlink/p/?LinkId=708533)
+[What's new in Active Directory Domain Services for Windows Server 2016](https://go.microsoft.com/fwlink/p/?LinkId=708533)
 
 [Windows Hello face authentication](https://go.microsoft.com/fwlink/p/?LinkId=626024)